DFIR Evidence Collection and Preservation for the Cloud

SANS DFIR Summit 2022

Speakers: Josh Lemon & Megan Roddie

The assumption that a change in where or how data is stored always seems to lead to the false belief that forensics is dead. With the cloud, digital forensics is given new capabilities and depth that do not exist in the on-premise world. However, this is only useful if you know how to correctly configure and set up evidence preservation for your cloud environments. One of the most significant challenges …

cloud collection dfir preservation