Cloud forensics is the collection and analysis of evidence from cloud services and infrastructure to investigate security incidents. Evidence may include provider-held platform and network logs, customer-accessible application and identity logs, virtual machine images, and records of configuration changes. Because responsibility and visibility are divided between the cloud provider and customer, investigators may need both parties to assemble a reliable timeline.
It matters because incomplete or short-lived logs can make it difficult to determine how an attacker gained access, which systems were affected, or whether data was viewed or copied. In practice, providers may preserve underlying infrastructure evidence while customers secure the logs they can access, check for unusual processes and outbound connections, and rotate potentially exposed credentials. Prompt coordination and evidence preservation help distinguish confirmed compromise from possible exposure.