Tools and techniques for digital forensic investigations
One of the challenges in any incident investigation is acquiring artifacts quickly and in a forensically sound manner. In some cases, investigators may collect artifacts to investigate the incident further and identify the root cause. Moving swiftly to collect artifacts and evidence is crucial to investigations. This section will explore some valuable host and memory artifacts for investigations.
Prerequisites
Before investigators can begin collecting their logs from the cloud console, we can utilize some of the prerequisites that were explored in previous chapters (enabling logs, audit trails, and so on), along with the ones listed here. These prerequisites will help investigators conduct their incident response activities much more smoothly:
- Instance protection: Some CSPs will allow instance protection once an incident is declared. For example, in AWS, you can configure your instance to prevent it from termination...
