Social Media, Insider, Cryptocurrency, Virtual, Cloud and Container Forensics

What it is

Modern cases rarely sit on one hard disk. Evidence lives on social platforms, in blockchain ledgers, in virtual machines, in cloud accounts and in containers that disappear within minutes. Each environment needs its own way of identifying, preserving and collecting evidence.

The exam asks which source or method fits a scenario, and what is different from classic disk forensics.

How it works

Social media forensics

Social media evidence includes posts, messages, photos, friend lists, login records and metadata.

• Preserve fast. Content can be deleted. Send a preservation request to the platform and capture pages with URL, date and time.
• Capture properly. Use tools that save full pages and metadata, hash the captures and record the account identifiers.
• Use legal process. Account holder data such as IP logs comes from the provider through a subpoena, court order or warrant, depending on the data.
• Authenticate. Show that the account belongs to the person, using linked emails, phone numbers, devices and writing patterns.

Public posts can be collected openly, while private content needs consent or legal process.

Social engineering forensics

Social engineering attacks trick people into giving access. The evidence is the trail left around the trick:

• phishing email headers and message source (sender path, authentication results for SPF, DKIM and DMARC)
• links, attachments and landing pages
• phone logs and voicemail for vishing, and text messages for smishing
• badge, visitor and camera records for physical pretexting
• logins and password resets that followed the contact

Insider threat and identity theft forensics

An insider has legitimate access, so the question is misuse, not intrusion.

Work with HR and legal teams, and preserve the evidence before the employee is told. For identity theft, the investigator looks at fraudulent accounts, credit reports, address changes, device and IP records of applications, and links the activity to the offender.

Cryptocurrency and blockchain forensics

A blockchain is a public ledger. Transactions are pseudonymous, not anonymous: addresses are visible, and names appear only when an address is tied to a person.

• Trace the flow of funds from address to address using block explorers and analytics tools.
• Cluster addresses that appear to be controlled by the same wallet.
• Identify the person through exchange records, which hold identity checks, obtained with legal process.
• Watch for mixers or tumblers, which are used to obscure the path of funds.
• Seize wallet files, hardware wallets and the recovery seed phrase. With the private key or seed, the holder controls the funds, so handle them very carefully and under legal authority.

Virtualization forensics

A virtual machine (VM) is a set of files on a host.

Useful methods: snapshot or suspend the VM so that memory is saved to a file, copy the disk files and hash them, collect hypervisor logs and check the host as well as the guest. Snapshots give a time series of states. Remember that a deleted VM leaves traces on the host file system.

Cloud forensics

In the cloud the investigator does not own the hardware. The shared responsibility model decides what the customer can collect, and the rest depends on the provider.

Collect through the provider's tools: audit logs such as AWS CloudTrail, Azure Activity Log and Google Cloud Audit Logs, disk snapshots, and network flow logs. Preserve with a snapshot, then hash and work on a copy.

Containers and microservices

Containers are short lived and share the host kernel. When one is stopped and removed, its writable layer may disappear.

• Capture logs first (docker logs <container>), then inspect the configuration (docker inspect <container>) and see changed files (docker diff <container>).
• Pause rather than stop where possible, with docker pause <container>.
• Export the file system (docker export <container> > case.tar) and hash the result.
• In Kubernetes, collect pod logs (kubectl logs <pod>), audit logs and node data before the pod is rescheduled.
• Collect from the host, the image registry and the orchestration layer. Microservices spread one event across many services, so centralized logging and trace IDs are needed to follow it.

A worked example

An employee leaves for a competitor. The investigator preserves the laptop image and finds a USB drive in the device history. Cloud logs show a bulk download to a personal account the day before resignation.

Legal approves the collection, and the report ties the dates together.

How the exam asks about this

• "Why are cryptocurrency transactions traceable?" → They are recorded on a public ledger, and addresses are pseudonymous.
• "Which model sets what a customer can collect in the cloud?" → The shared responsibility model.
• "Which Docker command shows changed files in a container?" → docker diff.