Traditional forensics versus cloud forensics

Traditional and cloud forensics play critical roles in incident response but differ in focus and methodologies due to the distinct environments they address.

Here are their similarities:

• Evidence collection: Both traditional and cloud forensics involve collecting and preserving digital evidence to reconstruct events leading to an incident. This may include collecting memory dumps, log files, network traffic, and filesystem artifacts. Investigators often use cloud storage to store large volumes of artifacts, irrespective of the underlying CSP, as most breaches affect a cloud tenant at a CSP. In scenarios where the underlying CSP is believed to be compromised, it is recommended that investigators save all the necessary artifacts in a different CSP storage or offline for analysis.
• Analysis techniques: Both domains employ similar techniques for analyzing digital evidence, such as examining file structures, metadata, timestamps...