Cloud Forensics

Two things, immediately: raise logging to the highest level available, and start exporting the logs you already have. Both cost nothing and cannot be done retroactively. Delete nothing, change no rules, and do not hastily disable the suspicious account — a disabled account warns the attacker before you know what they did.

Yes, but on a narrower basis. Some of the most informative logs are tied to higher tiers and cannot be generated retroactively. We tell you at the outset which questions your licence scope can answer and which stay open — rather than selling you a gap as a result at the end.

For the platform, yes. For your configuration, your permissions and your identities, no. Practically every incident we investigate arises on your side of that boundary — usually through a taken-over account. The provider supplies the logs; the assessment is yours to make.

Whatever is reachable through the usual interfaces we collect ourselves. Requests to the provider beyond that take time and do not always succeed. So we plan the investigation to work with the data you can reach yourself.

There is no storage medium to image and no memory to capture. In their place are logs that belong to somebody else and disappear on somebody else's schedule. So the order reverses: preserve first, then ask what should be investigated.