Page 1
CLOUD INFRASTRUCTURE · A GUIDE FOR UK LAWYERS Forensic Evidence from Cloud Infrastructure: AWS, Azure and Google Cloud Control-Plane Logs, Storage, Compute and the Evidence in the Account, Not the Server COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES CLOUD-INFRASTRUCTURE FORENSICS
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: there is no server to image 03 The control plane: who did what to the infrastructure 04 The data plane: storage, databases and what the applications did 05 Compute, snapshots and the ephemeral-evidence problem 06 Preservation and collection: holds, exports and who controls access 07 Deployment: breaches, configuration disputes and the departing engineer 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: CLOUD - INFRASTRUCTUREEVIDENCELIVESINTHEACCOUNT, NOT THE MACHINE: THE CONTROL - PLANELOGRECORDSWHODIDWHATTOTHE INFRASTRUCTURE, THEDATA - PLANELOGSRECORDWHATHAPPENEDTOTHEDATA, AND BOTHAREBILLED, RETAINEDBYPOLICYANDPRESERVABLEONLYTHROUGHTHE PROVIDER ' SOWNMECHANISMS, APPLIED EARLY
§ 02 · FIRST PRINCIPLES The problem in plain English: there is no server to image
§ 03 · THECONTROLPLANE The control plane: who did what to the infrastructure
Page 2
§ 04 · THEDATAPLANE The data plane: storage, databases and what the applications did
§ 05 · COMPUTE, SNAPSHOTSANDTHEEPHEMERAL - EVIDENCE PROBLEM Compute, snapshots and the ephemeral-evidence problem
§ 06 · PRESERVATION AND COLLECTION Preservation and collection: holds, exports and who controls access
§ 07 · DEPLOYMENT Deployment: breaches, configuration disputes and the departing engineer
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION PLANE HISTORY + CONTROL- NETWORK- PROVIDER + OPERATING PLANE LOG FLOW LOGS DESTINATION END POINT S DATA- CONFIG LOGS SNAPSHOTS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEOPENBUCKETANDTHELOGTHATHADITALL EXAMPLE2 · THE PRODUCTION DATABASE THAT WAS DELETED, ANDTHEIDENTITYTHAT DIDIT EXAMPLE3 · THEENGINEERWHOTOOKTHEINFRASTRUCTURE, NOT JUST THE DATA
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · CLOUD - INFRASTRUCTUREPRESER VAT IONNOTICE
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The cloud-infrastructure checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Our systems are all in AWS. Can you image the server? Someone deleted our production database. Can we prove who? We think data was taken from cloud storage, but there is no access log. Is it hopeless? A former engineer still had access to our cloud account. How serious is that? How long do we have before the evidence disappears? Does it matter which of AWS, Azure or Google Cloud we use?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Forensic Evidence From Cloud Infrastructure AWS Azure Google Cloud, Computer Forensics Lab, https://e-discovery.uk/library/forensic-evidence-from-cloud-infrastructure-aws-azure-google-cloud/pdf.