A Critical Review of Evidence Acquisition and Preservation in Software-as-a-Service Environments: Customer-Controlled Forensic Capabilities and Provider Dependencies

Abstract

Software-as-a-Service (SaaS) environments present distinctive challenges for digital forensic investigations because customers generally control user accounts, organizational configurations, and selected audit capabilities but do not control the underlying infrastructure. Consequently, the availability, completeness, and preservation of forensic evidence depend on both customer-managed settings and provider-operated systems. This critical narrative review examines the forensic implications of that division of control, focusing on evidence generation, accessibility, retention, preservation, and reliability. It evaluates the limitations of customer-accessible audit records, the significance of provider-controlled evidence, and the difficulties associated with acquisition through administrative interfaces and application programming interfaces. We distinguish routine administrative export from defensible forensic preservation and examine how licensing, retention settings, application design, and provider cooperation shape an investigation. A five-dimensional analytical framework is proposed to assess whether an organization can generate, access, retain, preserve, and substantiate evidence relevant to an incident. The framework can support forensic readiness assessments and incident investigations, but it is not a validated numerical scoring system. The analysis demonstrates that customer access to SaaS audit functionality does not establish complete forensic visibility and that reliable investigation requires a documented understanding of evidentiary boundaries, collection procedures, and provider dependencies