<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud Forensics — API Reference

## AWS CLI — Evidence Collection

### Instance Isolation

```bash
# Create isolation security group
aws ec2 create-security-group --group-name forensic-isolation --description "IR isolation" --vpc-id VPC_ID

# Remove egress
aws ec2 revoke-security-group-egress --group-id SG_ID --ip-permissions '[{"IpProtocol":"-1"}]'

# Apply to instance
aws ec2 modify-instance-attribute --instance-id INSTANCE --groups SG_ID

# Disable termination protection
aws ec2 modify-instance-attribute --instance-id INSTANCE --no-disable-api-termination
```

### Disk Snapshots

```bash
# Create snapshot
aws ec2 create-snapshot --volume-id VOL_ID --description "FORENSIC-CASE-DATE"

# Share with forensics account
aws ec2 modify-snapshot-attribute --snapshot-id SNAP --attribute createVolumePermission --operation-type add --user-ids ACCOUNT

# Create volume from snapshot
aws ec2 create-volume --snapshot-id SNAP --availability-zone AZ --volume-type gp3
```

### Log Collection

```bash
# CloudTrail lookup
aws cloudtrail lookup-events --lookup-attributes AttributeKey=Username,AttributeValue=USER --start-time START

# CloudWatch Logs Insights
aws logs start-query --log-group-name LOG_GROUP --start-time START --end-time END --query-string QUERY
aws logs get-query-results --query-id QUERY_ID

# VPC Flow Logs (via Athena)
# SELECT * FROM vpc_flow_logs WHERE srcaddr='IP' OR dstaddr='IP'
```

### Memory Acquisition

```bash
# Via SSM
aws ssm send-command --instance-ids INSTANCE --document-name AWS-RunShellScript \
  --parameters 'commands=["insmod lime.ko path=/tmp/mem.lime format=lime"]'
```

## Azure CLI — Evidence Collection

```bash
# Snapshot managed disk
az snapshot create -g RG -n forensic-snap --source DISK_ID

# Activity log
az monitor activity-log list --start-time START --end-time END --caller USER

# NSG flow logs
az network watcher flow-log show --nsg NSG --resource-group RG
```

## GCP CLI — Evidence Collection

```bash
# Snapshot disk
gcloud compute disks snapshot DISK --zone ZONE --snapshot-names forensic-snap

# Audit logs
gcloud logging read 'protoPayload.authenticationInfo.principalEmail="USER"' --freshness=7d

# VPC flow logs
gcloud logging read 'resource.type="gce_subnetwork"' --freshness=7d
```

## Forensic Tools

| Tool | Purpose |
|------|---------|
| Volatility 3 | Memory analysis |
| Sleuth Kit | Disk forensics |
| Plaso / log2timeline | Timeline generation |
| AVML | Linux memory acquisition |
| LiME | Linux memory module |
