Forensic Evidence From Cloud Infrastructure AWS Azure Google Cloud

CLOUDINFRASTRUCTURE · AGUIDEFORUKLAWYERS Forensic Evidence from Cloud Infrastructure: AWS, Azure and Google Cloud Control-Plane Logs, Storage, Compute and the Evidence in the Account, Not the Server COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES CLOUD-INFRASTRUCTURE FORENSICS § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: there is no server to image 03 The control plane: who did what to the infrastructure 04 The data plane: storage, databases and what the applications did 05 Compute, snapshots and the ephemeral-evidence problem 06 Preservation and collection: holds, exports and who controls access 07 Deployment: breaches, configuration disputes and the departing engineer 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : CLOUD - INFRASTRUCTUREEVIDENCELIVESINTHEACCOUNT , NOT THEMACHINE : THECONTROL - PLANELOGRECORDSWHODIDWHATTOTHE INFRASTRUCTURE , THEDATA - PLANELOGSRECORDWHATHAPPENEDTOTHEDATA , AND BOTHAREBILLED , RETAINEDBYPOLICYANDPRESERVABLEONLYTHROUGHTHE PROVIDER ' SOWNMECHANISMS , APPLIEDEARLY § 0 2 · FIRSTPRINCIPLES The problem in plain English: there is no server to image § 0 3 · THECONTROLPLANE The control plane: who did what to the infrastructure § 0 4 · THEDATAPLANE The data plane: storage, databases and what the applications did § 0 5 · COMPUTE , SNAPSHOTSANDTHEEPHEMERAL - EVIDENCEPROBLEM Compute, snapshots and the ephemeral-evidence problem § 0 6 · PRESERVATIONANDCOLLECTION Preservation and collection: holds, exports and who controls access § 0 7 · DEPLOYMENT Deployment: breaches, configuration disputes and the departing engineer § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION PLANE HISTORY + CONTROL- NETWORK- PROVIDER + OPERATING PLANE LOG FLOW LOGS DESTINATION ENDPOINTS DATA- CONFIG LOGS SNAPSHOTS § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEOPENBUCKETANDTHELOGTHATHADITALL EXAMPLE2 · THEPRODUCTIONDATABASETHATWASDELETED , ANDTHEIDENTITYTHAT DIDIT EXAMPLE3 · THEENGINEERWHOTOOKTHEINFRASTRUCTURE , NOTJUSTTHEDATA § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · CLOUD - INFRASTRUCTUREPRESER VAT IONNOTICE § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The cloud-infrastructure checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Our systems are all in AWS. Can you image the server? Someone deleted our production database. Can we prove who? We think data was taken from cloud storage, but there is no access log. Is it hopeless? A former engineer still had access to our cloud account. How serious is that? How long do we have before the evidence disappears? Does it matter which of AWS, Azure or Google Cloud we use? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY