This content is open to everyone — sign in to save your progress, earn points, and unlock module exams.
Topic 6.1 of Cloud Forensics and Incident Investigation
Why cloud forensics differs from traditional forensics, the three-dimensional model, three roles of cloud in crime, and RFC 3227 evidence order.
By the end of this topic, you will
Quadrant 1 · e-Tutorial
Quick Bite
Quadrant 2 · e-Content
Quadrant 3 · Web Resources
Downloadable reference material
External links
NIST IR 8006: NIST Cloud Forensic Science Challenges
The NIST interagency report identifying and categorising cloud forensic science challenges.
NIST IR 8006: NIST Cloud Forensic Science Challenges
The NIST interagency report identifying and categorising cloud forensic science challenges.
RFC 3227: Guidelines for Evidence Collection and Archiving
The foundational RFC establishing evidence acquisition order based on volatility.
RFC 3227: Guidelines for Evidence Collection and Archiving
The foundational RFC establishing evidence acquisition order based on volatility.
SWGDE Cloud Forensics Overview
Scientific Working Group on Digital Evidence guidance on cloud forensics principles.
SWGDE Cloud Forensics Overview
Scientific Working Group on Digital Evidence guidance on cloud forensics principles.
ENISA Cloud Incident Management
ENISA guidance on incident detection, response, and recovery specific to cloud environments.
ENISA Cloud Incident Management
ENISA guidance on incident detection, response, and recovery specific to cloud environments.
Quadrant 4 · Self-Assessment
Cloud Forensics and Incident Response
Cloud forensics dimensions, EC2 preservation, LiME, legal admissibility, and forensic tools.
Cloud Security: Complete Assessment
Comprehensive 120-question assessment covering all six chapters of the Cloud Security eBook 2026.
