Cloud Evidence Acquisition

Until now, we have looked at investigating artifacts locally within the cloud using the tools provided by the Cloud Service Provider (CSP). We looked at AWS GuardDuty CloudTrail from a logging and investigation point of view. We also looked at GCP’s Cloud Logging capability to investigate cloud logs emitted by various services, and Azure Monitor offers similar capabilities for services hosted within Microsoft Azure.

This chapter will take a step further in our cloud investigative journey and look at methods and techniques for securely collecting artifacts or forensic images of core services for offline analysis. Investigators will recognize that not all investigations can be performed using native cloud tools. Investigators may be required to use specialized tools that they have access to in a forensic environment, and the challenge will be to collect images from the cloud in a forensically sound and legally acceptable manner. We will explore these...