<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Cloud Forensics Reference

Evidence collection procedures for AWS, Azure, and GCP.

## AWS Evidence Collection
1. Snapshot EBS volumes (preserve disk state)
2. Export CloudTrail logs for affected time range
3. Capture VPC Flow Logs
4. Export GuardDuty findings
5. Preserve IAM access advisor data
6. Export S3 access logs for affected buckets

## Azure Evidence Collection
1. Snapshot managed disks
2. Export Activity Log and Sign-in Logs
3. Capture NSG Flow Logs
4. Export Defender for Cloud alerts
5. Preserve Azure AD audit logs
6. Export diagnostic settings data

## GCP Evidence Collection
1. Snapshot persistent disks
2. Export Cloud Audit Logs
3. Capture VPC Flow Logs
4. Export Security Command Center findings
5. Preserve IAM audit logs

## Chain of Custody in Cloud
- Use write-once storage (S3 Object Lock, Azure immutable blobs)
- Hash all evidence immediately after collection
- Document collection method, timestamp, and collector identity
- Maintain separate forensics account with restricted access
