THANK YOU FOR SUBSCRIBING
Enterprise Security Magazine | Friday, September 12, 2025
With the right tools and procedures, security teams can give analysts the crucial components to perform cloud computing forensics investigations.
Fremont, CA: Cloud forensics evidence collection and processing have become more convenient. Security teams may better handle this problem by knowing more about cloud forensic methodologies and technologies for enabling or automating investigations.
The digital forensics methodologies and technologies utilized vary depending on where security analysts collect data, such as workloads, containers, and other network locations.
Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.
Cloud Workload Collection
Evidence gathering for cloud workloads varies according to the workload type. Capturing disks in a running instance is comparable to capturing disks in virtual environments. Major IaaS providers allow users to conduct snapshot captures of their VM workload. Analysts may transform the snapshot into a live analysis volume and upload it to a cloud or on-premises forensics workstation. Customers in most cloud settings may immediately grab IaaS OS and data disks from the administration site.
A per-instance capture mechanism is required to capture a memory in a shared environment. Security teams require different remote or local technologies to collect the running memory of instances. Several tools are accessible for this purpose. For example, Microsoft's Acquire Volatile Memory for Linux (AVML) is a free, open-source application that collects memory from typical workload instances. Other free workload capture solutions include WinPmem for Windows and Linpmem for Linux.
Hibernating a workload is another way to create a memory capture on a local storage drive in various cloud settings, such as AWS. Google Cloud allows security teams to create a RAM disk for in-memory data. Many third-party agent-based solutions have been converted to run in cloud settings, making them potentially more viable for large companies.
Container Forensics Collection
Forensics in container-based setups is slightly different. Docker Forensics Toolkit and Docker Explorer may assist in assessing the shared union database with individual container records and container history in container settings when the company controls the underlying runtime engine.
A new feature in Kubernetes, the Kubelet Checkpoint API, allows analysts to create a copy or a running container image for offline analysis on cloud container infrastructure such as Amazon Elastic Kubernetes Service, Azure Kubernetes Service, and Google Kubernetes Engine. Please remember that this functionality may not be accessible in all PaaS models now.
Because there is rarely anything else to gather, serverless services should rely primarily on logs and actual code versions for proof.
More in News