THANK YOU FOR SUBSCRIBING
Enterprise Security Magazine | Friday, November 07, 2025
Fremont, CA: Gathering and processing data for cloud forensics has gotten easier. Understanding cloud forensic techniques and technologies for facilitating or automating investigations might help security teams better address this issue.
The digital forensics methodologies and technologies utilized vary depending on where security analysts collect data, such as workloads, containers, and other network locations.
Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.
Cloud Workload Collection
Evidence gathering for cloud workloads varies according to the workload type. Capturing disks in a running instance is comparable to capturing disks in virtual environments. Major IaaS providers allow users to conduct snapshot captures of their VM workload. Analysts may transform the snapshot into a live analysis volume and upload it to a cloud or on-premises forensics workstation. Customers in most cloud settings may immediately grab IaaS OS and data disks from the administration site.
A per-instance capture mechanism is required to capture a memory in a shared environment. Security teams require different remote or local technologies to collect the running memory of instances. Several tools are accessible for this purpose. For example, Microsoft's Acquire Volatile Memory for Linux (AVML) is a free, open-source application that collects memory from typical workload instances. Other free workload capture solutions include WinPmem for Windows and Linpmem for Linux.
Hibernating a workload is another way to create a memory capture on a local storage drive in various cloud settings, such as AWS. Google Cloud allows security teams to create a RAM disk for in-memory data. Many third-party agent-based solutions have been converted to run in cloud settings, making them potentially more viable for large companies.
Container Forensics Collection
Forensics in container-based setups is slightly different. Docker Forensics Toolkit and Docker Explorer may assist in assessing the shared union database with individual container records and container history in container settings when the company controls the underlying runtime engine.
A new feature in Kubernetes, the Kubelet Checkpoint API, allows analysts to create a copy or a running container image for offline analysis on cloud container infrastructure such as Amazon Elastic Kubernetes Service, Azure Kubernetes Service, and Google Kubernetes Engine. Please remember that this functionality may not be accessible in all PaaS models now.
Because there is rarely anything else to gather, serverless services should rely primarily on logs and actual code versions for proof.
More in News