Cloud Forensics

Cloud forensics involves the collection, preservation, and analysis of digital evidence from cloud environments following a security incident. Cloud forensics differs from traditional forensics because evidence is stored across distributed services, logs may have limited retention windows, and shared infrastructure limits physical access to hardware.

Key evidence sources include cloud audit logs, VPC flow logs, object storage access logs, and memory snapshots from isolated instances.