A digital forensic evidence data capture tool for a cloud computing system

An evidence data capture tool comprises a record device (1), which comprises a control processor (2), a transaction data store (10), a target data store (9), and an output (7). In use, the control processor (1) communicates with a target device via a network (11). The target device may comprise one or more elements of a distributed system (e.g. cloud computing system). Target data is downloaded from the target device to the record device (1). Associated transaction data is stored in the transaction data store (10) of the record device (1). A security marker such as a hash is applied to the target data and its associated transaction data. The record device (1) outputs a copy of the marked target and transaction data. The transaction data may comprise audio, video, or still image recordings of user activity on the record device during target data downloading.