Performing Cloud Forensics Investigation

When to Use

• When investigating a security breach in AWS, Azure, or GCP cloud environments
• For collecting volatile and non-volatile evidence from cloud infrastructure
• When tracing unauthorized access through cloud service API logs
• During incident response requiring preservation of cloud-based evidence
• For analyzing compromised virtual machines, containers, or serverless functions

Prerequisites

• Administrative access to the cloud account under investigation
• AWS CLI, Azure CLI, or gcloud CLI configured with appropriate permissions
• Understanding of cloud-native logging (CloudTrail, Activity Log, Audit Log)
• Forensic workstation with cloud SDKs installed
• Knowledge of IAM, networking, and compute services in target cloud
• Evidence preservation procedures for cloud environments

Workflow

Step 1: Preserve Cloud Evidence and Establish Scope

# === AWS Evidence Preservation ===
# Snapshot compromised EC2 instance volumes
INSTANCE_ID="i-0abc123def456789"
VOLUME_IDS=$(aws ec2 describe-instances --instance-ids $INSTANCE_ID \
   --query 'Reservations[].Instances[].BlockDeviceMappings[].Ebs.VolumeId' --output text)

for vol in $VOLUME_IDS; do
   aws ec2 create-snapshot --volume-id $vol \
      --description "Forensic snapshot - Case 2024-001 - $(date -u)" \
      --tag-specifications "ResourceType=snapshot,Tags=[{Key=Case,Value=2024-001},{Key=Evidence,Value=true}]"
done

# Capture instance metadata
aws ec2 describe-instances --instance-ids $INSTANCE_ID \
   > /cases/case-2024-001/cloud/instance_metadata.json

# Capture security group rules
aws ec2 describe-security-groups --group-ids $(aws ec2 describe-instances \
   --instance-ids $INSTANCE_ID --query 'Reservations[].Instances[].SecurityGroups[].GroupId' --output text) \
   > /cases/case-2024-001/cloud/security_groups.json

# Capture network interfaces
aws ec2 describe-network-interfaces --filters "Name=attachment.instance-id,Values=$INSTANCE_ID" \
   > /cases/case-2024-001/cloud/network_interfaces.json

# Isolate the instance (replace security group with forensic isolation SG)
aws ec2 modify-instance-attribute --instance-id $INSTANCE_ID \
   --groups sg-forensic-isolation

# === Azure Evidence Preservation ===
# Snapshot a compromised VM disk
az snapshot create --resource-group forensics-rg \
   --name "case-2024-001-osdisk-snapshot" \
   --source "/subscriptions/SUB_ID/resourceGroups/RG/providers/Microsoft.Compute/disks/vm-osdisk"

# === GCP Evidence Preservation ===
gcloud compute disks snapshot compromised-disk \
   --snapshot-names="case-2024-001-forensic" \
   --zone=us-central1-a

Step 2: Collect Cloud API and Access Logs

# === AWS CloudTrail Logs ===
# Download CloudTrail events for the investigation period
aws cloudtrail lookup-events \
   --start-time "2024-01-15T00:00:00Z" \
   --end-time "2024-01-20T23:59:59Z" \
   --max-results 1000 \
   > /cases/case-2024-001/cloud/cloudtrail_events.json

# Filter for specific user activity
aws cloudtrail lookup-events \
   --lookup-attributes AttributeKey=Username,AttributeValue=compromised-user \
   --start-time "2024-01-15T00:00:00Z" \
   > /cases/case-2024-001/cloud/user_activity.json

# Download S3 access logs
aws s3 sync s3://my-cloudtrail-bucket/AWSLogs/ /cases/case-2024-001/cloud/cloudtrail_s3/

# Query CloudTrail with Athena for large-scale analysis
aws athena start-query-execution \
   --query-string "SELECT eventTime, eventName, userIdentity.arn, sourceIPAddress, errorCode
                   FROM cloudtrail_logs
                   WHERE eventTime BETWEEN '2024-01-15' AND '2024-01-20'
                   AND sourceIPAddress NOT IN ('10.0.0.0/8')
                   ORDER BY eventTime" \
   --result-configuration OutputLocation=s3://forensics-bucket/athena-results/

# === AWS VPC Flow Logs ===
aws logs filter-log-events \
   --log-group-name "vpc-flow-logs" \
   --start-time $(date -d "2024-01-15" +%s000) \
   --end-time $(date -d "2024-01-20" +%s000) \
   --filter-pattern "ACCEPT" \
   > /cases/case-2024-001/cloud/vpc_flow_logs.json

# === Azure Activity Log ===
az monitor activity-log list \
   --start-time "2024-01-15T00:00:00Z" \
   --end-time "2024-01-20T23:59:59Z" \
   --output json > /cases/case-2024-001/cloud/azure_activity.json

# === GCP Audit Logs ===
gcloud logging read 'logName="projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Factivity"
   AND timestamp>="2024-01-15T00:00:00Z"

…