CLD-000 Cloud Services
I have been given evidence involving a cloud service — where do I start?¶
Begin by identifying the service, separating the evidence sources, recording the account and access route, preserving volatile records and defining the exact investigative question.
Evidence and questions to consider¶
- service type and function;
- device, provider and organisational evidence sources;
- account or tenant identifiers;
- dates, times, devices, IP addresses and sessions;
- shared links and connected applications;
- preservation risks and the question to be answered.
Keep the sources separate¶
A provider record, customer-administrator report, application screen and device artefact may describe related activity without proving the same thing. Preserve exact identifiers, dates, times and time zones, and test shared access, delegation, automation, compromise and changing account control.
Key takeaway
Do not assume all relevant evidence is on the device or that the named account identifies the responsible person.