NetworkNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.Cloud Storage Investigation
Collect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.
- Intermediate
- Online or on campus
- 5 hands-on labs
- 6 modules
About this course
A finance team member clicks a fake Microsoft login page. Two days later a vendor gets an email from her real mailbox asking for payment to a new bank account. There is no laptop to seize that holds the answer. The evidence is in Microsoft 365 sign-in records, mailbox audit events and inbox rules, and some of it will be gone if nobody pulls it soon.
This course teaches you to investigate accounts and data held by cloud providers. You work with AWS CloudTrail, the Microsoft 365 Unified Audit Log and Google Workspace audit logs. You learn what each one records by default, what has to be switched on in advance and how long each record is kept.
Cloud evidence also raises questions a hard disk never does. Who owns the data, who can lawfully collect it and how do you prove that an export was not changed? The course covers preservation, hashing of exports and the legal routes for getting data from providers, including notices under the Bharatiya Nagarik Suraksha Sanhita 2023 and requests to providers based outside India.
AWS CloudTrailMicrosoft 365 audit logGoogle WorkspaceLegal requests
After this course you can
- Explain the shared responsibility model and what evidence the provider holds compared with the customer
- Query AWS CloudTrail for API activity and trace actions back to a user, role and source IP
- Search the Microsoft 365 Unified Audit Log for sign-ins, mailbox access and inbox rule changes
- Pull Google Workspace login, Drive and Gmail audit events and preserve mail and files with Google Vault
- Collect cloud logs and data in a way that is hashed, documented and repeatable
- Prepare a preservation request or legal notice to a cloud provider with the right details
Syllabus
6 modules · 25 topics
01How cloud evidence is different4 topics
- IaaS, PaaS and SaaS and who controls which logs
- Retention limits and why the first 24 hours matter
- Collecting with the customer's admin rights compared with requests to the provider
- Time in UTC and keeping a clean record of every query you run
02AWS investigations5 topics
- CloudTrail event history compared with trails saved to S3
- Reading userIdentity, eventName, sourceIPAddress and userAgent
- Management events compared with S3 data events, which are off by default
- VPC Flow Logs, S3 access logs and GuardDuty findings
- Snapshotting an EC2 volume for disk forensics
03Microsoft 365 investigations4 topics
- Searching the Unified Audit Log in Microsoft Purview and with Search-UnifiedAuditLog
- Entra ID sign-in logs, risky sign-ins and MFA records
- Business email compromise signs: new inbox rules, forwarding and mail access from new IPs
- OneDrive and SharePoint file access and sharing events
04Google Workspace investigations4 topics
- Admin console audit and investigation pages for login, Drive, Gmail and admin events
- Tracing who shared a Drive file outside the organisation
- Using Google Vault holds and exports to preserve mail and files
- Reading OAuth app grants that give third parties access to data
05Preserving cloud evidence4 topics
- Export formats and hashing every file you collect
- Collection logs: who ran what, when and from which account
- Legal holds and retention policies before data ages out
- Avoiding changes to the account you are investigating
06Legal process with providers4 topics
- Preservation requests and why they come before production requests
- Notices under Section 94 of the Bharatiya Nagarik Suraksha Sanhita 2023 (earlier Section 91 CrPC)
- Data held outside India, provider law enforcement portals and MLAT requests
- The CERT-In direction that service providers keep ICT system logs for 180 days
Hands-on labs
- Lab 1
Trace an unauthorised S3 bucket download in CloudTrail back to the access key and source IP
- Lab 2
Investigate a business email compromise in a test Microsoft 365 tenant and find the malicious inbox rule
- Lab 3
Find who shared a confidential Google Drive folder outside the organisation and when
- Lab 4
Export and hash audit logs from all three platforms and write a collection record
- Lab 5
Draft a preservation request to a cloud provider for a sample case
Tools you will use
- AWS CloudTrail
- AWS CLI
- Microsoft Purview Audit
- Microsoft Extractor Suite
- Google Vault
- Magnet AXIOM Cyber
Who it suits
- Cybercrime investigators who send requests to cloud and email providers
- Company IT and security teams that run Microsoft 365, Google Workspace or AWS
- Incident responders handling account takeover and email fraud
- Lawyers and compliance staff who need to understand cloud evidence
Before you join
- Basic familiarity with at least one of AWS, Microsoft 365 or Google Workspace
- Understanding of IP addresses and login concepts such as MFA
- Network Traffic Analysis or Basics of Cyber Forensics helps
Questions about this course
Can I log in to a suspect's cloud account to collect evidence?
Only with proper legal authority or the account owner's documented consent. Logging in without authority can be an offence and can make the evidence hard to use. The course explains the lawful routes, including organisation admin access and requests to the provider.
How long do cloud providers keep audit logs?
It depends on the provider, the service and the licence the customer has, and it changes over time. Some records are kept for weeks and others for a year or more. The course shows you how to check retention on each platform and why you should preserve logs early.
Do I need my own AWS or Microsoft 365 account for the labs?
No. The labs use prepared test environments and sample log sets so you can practise without touching a real organisation's data.
More courses in Network & Cloud Forensics
NetworkNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.
NetworkWireshark / Packet CaptureCapture, filter and read packets in Wireshark and tshark to recover what was sent.
NetworkVirtual Machine / Hypervisor ForensicsExamine VMDK, VHDX and QCOW2 disks, snapshots, ESXi logs and VM memory files.Not sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.