Page 1

CLOUD INFRASTRUCTURE · A GUIDE FOR UK LAWYERS Forensic Evidence from Cloud Infrastructure: AWS, Azure and Google Cloud Control-Plane Logs, Storage, Compute and the Evidence in the Account, Not the Server COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES CLOUD-INFRASTRUCTURE FORENSICS

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: there is no server to image 03 The control plane: who did what to the infrastructure 04 The data plane: storage, databases and what the applications did 05 Compute, snapshots and the ephemeral-evidence problem 06 Preservation and collection: holds, exports and who controls access 07 Deployment: breaches, configuration disputes and the departing engineer 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: CLOUD - INFRASTRUCTUREEVIDENCELIVESINTHEACCOUNT, NOT THE MACHINE: THE CONTROL - PLANELOGRECORDSWHODIDWHATTOTHE INFRASTRUCTURE, THEDATA - PLANELOGSRECORDWHATHAPPENEDTOTHEDATA, AND BOTHAREBILLED, RETAINEDBYPOLICYANDPRESERVABLEONLYTHROUGHTHE PROVIDER ' SOWNMECHANISMS, APPLIED EARLY

§ 02 · FIRST PRINCIPLES The problem in plain English: there is no server to image

§ 03 · THECONTROLPLANE The control plane: who did what to the infrastructure