thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Cloud Forensics

Forensic investigation of incidents in cloud environments, relying on provider logs, snapshots and APIs.

Definition

Investigators often cannot seize physical hardware, so they collect evidence via audit logs such as AWS CloudTrail, Azure Activity Logs and Google Cloud Audit Logs, VM disk snapshots, memory captures and flow logs. The shared responsibility model and log retention settings determine what evidence exists.

Example

Snapshotting a compromised EC2 instance's EBS volume and reviewing CloudTrail for the attacker's API calls.

Exam tip

Enable cloud audit logging in advance; evidence that was never logged cannot be recovered.

Related terms