Question 1

Our systems are all in AWS. Can you image the server?

Accepted Answer

There is no server to image in the traditional sense (§2): the evidence is in the account: the control-plane log of who did what (§3), the data-plane access logs (§4), and snapshots of any running instance's storage (§5). The right first step is not imaging but preserving those logs and snapshots through AWS's own mechanisms before retention and auto-scaling remove them.

Question 2

Someone deleted our production database. Can we prove who?

Accepted Answer

Usually to the identity, often to the person: the deletion is a single control-plane API call recorded with the calling identity, source IP and time (§3, Example 2), and the identity and sign-in logs join it to a session and account. Automation is distinguished from a human by the nature of the calling identity, and the person behind a role is found from the identity provider's logs and the end point.

Question 3

We think data was taken from cloud storage, but there is no access log. Is it hopeless?

Accepted Answer

Object-level logging is off by default and its absence is a common first finding (§4), but not the end: the control plane records the access-permission changes that enabled it, network-flow logs record the egress volume, snapshots hold the store's prior state, and the destination account (§8) holds what left (guide 111). The case shifts to the alternates, and the report states which carried it.

Question 4

A former engineer still had access to our cloud account. How serious is that?

Accepted Answer

Potentially very: unrevoked credentials let a leaver read, take or destroy the estate, and the control-plane log records what ever they did (Example 2, Example 3): the failure to revoke is itself a finding, and the acts are attributed to their identity. Preserve the logs, revoke access, snapshot what is perishable, and examine the leaver's end point s for the credentials and code they took.

Question 5

How long do we have before the evidence disappears?

Accepted Answer

Less than you think: control-plane management-event history has a default window, log-group and activity-log retention is configurable and often short, and compute auto-scales away continuously (§5, §6). Preservation: extending retention, export in g logs, snapshotting volumes, protecting backups: is the first and most time-critical act, because the provider's lifecycle policies delete on schedule regardless of the dispute.

Question 6

Does it matter which of AWS, Azure or Google Cloud we use?

Accepted Answer

The principles are identical: control plane, data plane, identity, configuration history, snapshots, retention: but the service names, log formats, default settings and export tools differ per platform (§3-§6), and hybrid and multi- cloud estates need the guide 96 timeline to normalise logs across them. The examiner reads each platform on its own terms and reconciles them into one account of events. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

Forensic Evidence From Cloud Infrastructure AWS Azure Google Cloud