Cloud forensics
Also known as: Cloud-Forensik
Forensic acquisition and analysis in environments whose hardware a provider controls, where data is stored distributed and may be deleted automatically.
The cloud lacks the preconditions of classic forensics: no physical access, no complete image, often no access to infrastructure logs. Evidence is spread across regions and jurisdictions, and acquisition depends on the provider's cooperation. The European Union Agency for Law Enforcement Cooperation (incl. EC3) (Europol) report sees the largest standardisation gap here. Companies should settle before an incident which logs their provider retains, for how long, how they are exported and who may access them – afterwards it is too late.