CLD-006 Cloud Services
What types of cloud service might appear in an investigation?¶
Cloud services include far more than file storage. The function of the service determines which records may exist, who may hold them and what should be requested.
Evidence and questions to consider¶
- online email and messaging;
- storage, photo libraries and backups;
- collaboration and business applications;
- virtual servers and databases;
- security and remote-access services;
- linked applications, service accounts and automation.
Keep the sources separate¶
A provider record, customer-administrator report, application screen and device artefact may describe related activity without proving the same thing. Preserve exact identifiers, dates, times and time zones, and test shared access, delegation, automation, compromise and changing account control.
Key takeaway
Identify what the service actually does before deciding which evidence to seek.