Cloud-Based Forensics Services

Modern Forensics for Modern Systems

When considering mission-critical data that drives organizations today, chances are that data is in remote servers and networks which comprise the “cloud”. Cloud-based solutions like Microsoft 365, Google’s G-Suite, Slack and more have become where organizations conduct business today. Now, over 98% of organizations use the cloud in some way, whether through SaaS applications or a fully cloud-native network, and 63% of IT decision-makers state that their organization has accelerated its migration to the cloud over the past 12 months.

While the move “to the cloud” has accelerated in recent years, the concept is not new – data has been in the “cloud” for years. Forensic Discovery has been providing forensic analysis and collection of data from cloud-based data repositories from the beginning – we understand the unique requirements and considerations associated with data in the “cloud” to ensure that the evidence can be collected in a forensically-sound manner, analyzed and presented to meet the needs of your case. Forensic Discovery is what we do – on premise or in the cloud!

Scope of Services

At Forensic Discovery, our team of investigators combines best practices for digital forensic collection with advanced techniques that have evolved with the move of data to the cloud.  Here’s how we provide cloud-based forensics services to our clients:

Common Cloud-Based Solutions Supported

Our cloud-based forensics services cover a wide range of popular cloud platforms, ensuring that we can support your organization’s specific needs. Some of the common cloud-based solutions we support include:

• Office 365 and Google Workspace: Focused analysis on email systems, file storage, and collaboration tools, ensuring a thorough investigation of any data breaches or unauthorized access.
• Other SaaS Applications: Specialized support for investigating incidents within SaaS environments, including data leakage, unauthorized access, and compliance violations. Here are some examples of applications and platforms we support:
  • Dropbox
  • Box
  • Slack
  • Salesforce
  • iCloud
  • IBM Cloud
  • Oracle Cloud
  • Citrix ShareFile
  • ServiceNow
  • Zoho
  • Adobe Document Cloud
  • Trello
  • Asana
• Microsoft Azure: Forensics services for Azure virtual machines, blob storage, Azure SQL, and Azure Activity Logs to uncover and analyze security incidents.
• Amazon Web Services (AWS): Comprehensive forensic analysis of AWS cloud environments, including EC2 instances, S3 buckets, CloudTrail logs, and more.
• Google Cloud Platform (GCP): Expertise in GCP environments, including Google Compute Engine, Cloud Storage, and Cloud Audit Logs, to track and investigate malicious activities.

How Our Cloud-Based Forensics Differs from On-Premises Forensics

While traditional digital forensics often focuses on physical hardware and on-premise networks, cloud-based forensics presents unique challenges and opportunities. Here are some key differences in how Forensic Discovery provides forensics services in the cloud:

1. Data Location and Access: In cloud environments, data can be distributed across multiple geographic regions and managed by third-party service providers. We understand cloud architecture and have the necessary permissions and tools to access data remotely.
2. Shared Responsibility Model: Cloud providers operate under a shared responsibility model, meaning that while they secure the infrastructure, the organization is responsible for securing data and managing access. Our forensic investigations in the cloud consider both aspects to fully understand the scope and impact of an incident.
3. Dynamic and Scalable Environments: Cloud environments are highly dynamic, with resources that can be spun up or down in real-time. Our forensic approach can quickly adapt to those dynamic changes and capture relevant data before it is lost.
4. Logs and Metadata: Cloud platforms provide extensive logging and metadata, which are crucial for forensic analysis. Our experts have the specialized expertise and tools necessary for understanding and correlating these logs across different services and environments.
5. Legal and Compliance Considerations: We understand how to navigate various legal and compliance frameworks, especially when dealing with cross-border data storage and privacy regulations, when conducting forensics in the cloud.