Cloud evidence lifecycle framework: a six-stage log-centric method for multi-tenant AWS forensic investigations

Area of Science:

• Digital Forensics
• Cloud Computing Security
• Information Security

Background:

• Traditional digital forensics relies on physical evidence seizure.
• Multi-tenant cloud environments like Amazon Web Services (AWS) present unique challenges for forensic investigations.
• Existing forensic methods are not optimized for cloud-native architectures and log-centric data.

Purpose of the Study:

• To introduce the Cloud Evidence Lifecycle Framework (CELF), a novel six-stage forensic methodology.
• To adapt forensic practices for multi-tenant AWS environments, focusing on log-centric data.
• To provide a replicable blueprint for cloud forensics aligned with NIST guidelines.

Main Methods:

• Developed a six-stage forensic methodology (CELF) emphasizing log-centric data and immutability.
• Mapped CELF stages to native AWS services including CloudTrail, S3 Object Lock, IAM, VPC Flow Logs, AWS Config, and CloudWatch.
• Incorporated tenant boundary validation and log integrity controls within each stage.
• Validated the framework in a controlled two-tenant AWS environment.

Main Results:

• Demonstrated successful capture of all API activity within the test environment.
• Confirmed log immutability for evidence preservation.
• Achieved chronological reconstruction of events across multiple AWS services without requiring hypervisor access.
• Validated tenant boundary controls and log integrity.

Conclusions:

• The Cloud Evidence Lifecycle Framework (CELF) provides an effective, log-centric approach to digital forensics in multi-tenant AWS environments.
• CELF ensures data integrity and enables reliable reconstruction of events, replacing traditional physical evidence seizure.
• The framework offers a practical, configuration-level blueprint aligned with NIST SP 800-201 for cloud forensic investigations.