Cloud and IoT Forensics for Azure, AWS, Google and Smart Devices

What it is

In the cloud the investigator does not hold the hardware. Evidence comes from provider logs, snapshots of virtual disks and account data, and access depends on what the customer controls and what the provider shares.

This page covers the shared responsibility split, the main logs and acquisition methods for Azure, AWS and Google, cloud storage and Workspace, and two IoT devices: a smartwatch and an Amazon Echo.

How it works

Division of responsibilities

For forensics, this means a customer cannot image the physical disk or the hypervisor, and logs outside their control need a request to the provider. Multi tenancy, data location, legal jurisdiction and the service agreement all shape what can be collected.

Where data is stored in Azure

Logs in Azure

Export logs to a storage account or Log Analytics workspace early, since defaults expire.

Acquiring a VM in Azure

Preserve first, then analyze elsewhere.

1. Restrict network access, for example with a deny rule on the network security group, rather than deleting the VM.
2. Capture volatile data if possible, such as memory, before stopping the VM.
3. Take a snapshot of each managed disk.
4. Create a disk from the snapshot in a separate forensic resource group or subscription.
5. Attach the new disk read only to a forensic workstation VM, hash it and analyze the copy.

Acquiring a VM snapshot using the Azure Portal and PowerShell

In the Portal, open the VM, select Disks, open the OS disk and choose Create snapshot. In PowerShell the same job uses these cmdlets:

$vm = Get-AzVM -ResourceGroupName "rg-prod" -Name "vm01"
$cfg = New-AzSnapshotConfig -SourceUri $vm.StorageProfile.OsDisk.ManagedDisk.Id -Location $vm.Location -CreateOption Copy
New-AzSnapshot -Snapshot $cfg -SnapshotName "vm01-os-evidence" -ResourceGroupName "rg-prod"

Grant-AzSnapshotAccess can create a time limited read link to export the snapshot to a forensic storage account.

AWS forensics

For an EC2 instance: isolate it with a restrictive security group, keep it running if memory is needed, snapshot its EBS volumes (aws ec2 create-snapshot --volume-id vol-0abc123 --description "evidence"), create volumes from the snapshots in a forensic account, and attach them to an analysis instance to mount read only. Enable termination protection so the instance cannot be removed.

Cloud storage forensics

Services such as Dropbox, OneDrive and Google Drive keep data in the provider cloud and in a local sync folder. Evidence includes sync client databases and logs, cached files, version history, deleted file recycle areas, browser history and provider audit logs of sharing and downloads. For Google Drive for desktop, local data is under %LOCALAPPDATA%\Google\DriveFS. Cloud copies are acquired through the account with legal authority, not by guessing credentials.

Google Workspace forensics

Place a hold in Vault early so users cannot delete the data.

Google Cloud forensics

Cloud Audit Logs have four types: Admin Activity (always on), Data Access (off by default for most services), System Event and Policy Denied. VPC Flow Logs and Cloud Logging add network and application data. A disk is preserved with gcloud compute disks snapshot DISK_NAME --snapshot-names=evidence-snap --zone=ZONE, then a new disk is built with gcloud compute disks create forensic-disk --source-snapshot=evidence-snap --zone=ZONE.

Smartwatch forensics

A wearable stores heart rate, steps, sleep, location, notifications and messages. Storage is small and old data is overwritten, so act quickly. Data comes from three places: the watch, the paired phone app and the vendor cloud account. Most examinations start with the phone and cloud because the watch exposes little. Use a Faraday bag or disable networks to prevent changes.

Amazon Echo forensics

An Echo keeps little on the device. Voice recordings and history are stored in the Amazon account and shown in the Alexa app. Evidence sources are the companion app on the phone, the cloud account (with consent or legal process), home network logs and, for advanced cases, hardware level extraction. Commands, timestamps, linked devices and routines are the key items.

A worked example

An analyst finds a compromised Azure VM. The Activity log shows a role change at 14:05 by a stolen account. She applies a deny rule to the NSG, snapshots the OS disk, creates a disk in a forensic subscription, hashes it and attaches it to a workstation VM.

Then she exports the Activity and Entra sign in logs before their retention ends. The original VM is left in place, stopped only after the memory capture.

How the exam asks about this

• "Which Azure log records control plane operations on resources?" -> The Activity log.
• "Which AWS service records API calls?" -> CloudTrail.
• "Where does an Amazon Echo's voice history mainly reside?" -> In the Amazon cloud account, visible in the Alexa app.