CyberGlossary

Forensics & IR

Cloud Forensics

Also known as: Cloud incident forensics, SaaS forensics

Definition

Forensic investigation of cloud-hosted infrastructure, applications, and SaaS services, working with provider APIs, audit logs, and ephemeral resources.

Cloud forensics adapts traditional forensic principles to multi-tenant, elastic, API-driven environments. Investigators rely on provider audit logs (AWS CloudTrail, Azure Activity/Sign-in, Google Cloud Audit Logs), control-plane events, identity logs (Entra ID, Okta), VPC flow logs and storage access logs alongside guest-level evidence from EC2/Compute VMs or Kubernetes nodes. Acquisition methods include snapshotting EBS or managed disks, exporting object storage, and pulling memory from running instances via SSM/AVML. Challenges include shared responsibility limits, data residency, log retention gaps, and rapid resource deletion. Standards such as NIST IR 8006, ISO/IEC 27050, and CSA guidance shape repeatable processes for DFIR teams.

Examples

  • Tracing an AWS account compromise through CloudTrail to a stolen IAM access key.
  • Snapshotting an Azure VM disk and live-acquiring its memory via Run Command for analysis.

Related terms