With an ever-changing set of hosts and data centers, the cloud creates a significantly challenging environment for digital forensic investigation. The forensic investigator often meets inconvenience while identifying the location or the physical devices that reside the data. Data provenance is the solution for identifying the physical device that is to be used for investigation, which provides the information regarding originated location, tags on data, and the path of the data execution on nodes in the cloud. Hence, to ease the investigation process, identifying the originated location of the data as well as the data path in the cloud is crucial while ensuring security.