A checksum on a downloaded archive answers a local byte-integrity question. It does not show which accounts were searched, whether an export finished, or whether the service recorded the activity of interest. Verify a cloud collection as a sequence of distinct claims: source selection, job completion, delivered objects, and the working copy used for analysis.
Write the export contract first
Record the service, tenant or account identifier, collection role, regions, requested interval, event types, filters, and export format. Preserve the query exactly, including its time basis. Identify whether the operation exports an underlying record, a search result, a report, or a rendered view. These objects can support different questions. A screenshot of a successful job is useful context; keep the corresponding job identifier and machine-readable output too.
Reconcile what the job actually delivered
Keep a manifest of object names, sizes, local hashes, and collection times. Compare expected and received parts against the job's own completion and exception records. For a paginated collection, record the page sequence and terminal condition without placing reusable access credentials in the evidence package. Document retries and overlaps so duplicate records do not inflate event counts. If the service supplies a count, state whether it counts records, files, search hits, or another unit.
Preserve the service's verification material
AWS CloudTrail documentation distinguishes enabling digest delivery from actually validating the delivered files. Its documented integrity scheme concerns files after CloudTrail delivery; it does not establish that every relevant action was configured for recording. Preserve applicable digest objects and validation output alongside the logs. Record the validator version, account and region context, interval, and errors. A local hash list and a service validation result are complementary records.
The CloudTrail digest structure reference explains that a digest's own signature is stored in S3 object metadata and that backfill digests can exist. This makes a plain copy of compressed file bodies a potentially incomplete verification package. Decide what metadata your collection must retain, check it explicitly, and document any material that the export path cannot preserve. Treat this as a CloudTrail-specific example; verify another service's documented scheme separately.
Keep coverage separate from integrity
Build a small coverage table with one row per account, source type, and requested interval. Mark collection completed, partial, unavailable, or not requested. Describe disabled recording, unsupported event categories, access limits, and retention gaps where known. Do not convert an empty export into a conclusion that nothing happened. A useful conclusion names both the verified objects and the untested coverage assumptions.
Deliver a reviewable collection
Provide the original export, verification material, manifest, query and job records, and a readable exception log. Keep a separate analysis derivative with a documented transformation path. Another examiner should be able to identify the exact input behind a reported event without rerunning an expired service query. Restrict sensitive identifiers and credentials through the organization's normal handling process.
- Verify working copies
Track subsequent transfers independently of service coverage.
- Review an empty result
Test generation, retention, acquisition, and recognition before interpreting absence.