Ease and support for cloud-based data storage It has supported an increase in the number of cloud services. The increasing number of uses for cloud services also increases the number of digital-based criminal actions related to the addition of facilities to cloud services. The cloud service feature designed to store data to support the smooth running of business processes can be misused by criminal assistance to store crime data. Accurate digital evidence is one way to prove a digital crime, which can then be used as supporting evidence in the trial. This study discusses the analysis of digital evidence from a cloud service. The analysis process using the NIST 800-86 method is carried out on digital evidence from 5 previously prepared scenarios related to the use of cloud service features that use being misused. Data acquisition techniques use the method of direct acquisition and physical imaging to obtain digital evidence. The experimental results showed that after scenario 1 and scenario 3, information on the file name and directory of the paths downloaded by client 1 and client 2 were obtained with information on the IP address, mac address, user name, password and time stamp. After scenario 2, digital evidence has been obtained that contains information on the name and location of the folder on the cloud server. After scenario 4, information on the name of the file and the shared folder is successfully obtained, equipped with client information that has the right to access the files and folders. After scenario 5, information about the file name and directory of the file path is successfully obtained.