We will detail the various sources of evidence that may reside in the cloud, the prerequisites needed to access it, and discuss the best ways to collect and analyze that data to ensure integrity is maintained and you get all the relevant data you need for your investigation. The focus will be on data sources stored in AWS and Azure but we will also call out situations where cloud data may need to be collected elsewhere as well. As with anything in DFIR, there isn’t always one answer that fits every situation so we’ll discuss several options.

‍


‍