How to pull a defensible disk image off a running or compromised GCE instance without touching the original evidence. Compute Engine is where most GCP incidents eventually lead you — a web app got popped, a cron job got tampered with, a build agent got used to mint tokens it shouldn't have. The good news is that acquiring forensic evidence off a GCE instance is one of the cleaner workflows in cloud IR, because Persistent Disks are separate resources from the VM they're attach

When people say "compute" in Google Cloud, they're really talking about anything that burns CPU. If it runs code, processes data, or executes workloads — it falls under compute. For investigations, though, not all compute is equal. Some services give you deep visibility. Others hide almost everything. Here's the case we'll come back to throughout this article: a billing alert flags an unexpected spike in Compute Engine usage on a project called fernbridge-prod. Nobody on the

You've seen Vault mentioned twice already in this series — once as "the evidence room" in the Drive exposure article, once in passing in the Takeout article. Both times, the same line: Vault is what you use when you actually need the file. That's true. It's also not the whole story. Vault is a legal hold and eDiscovery tool first, and an investigator's tool second. Those two jobs pull in different directions, and if you don't know where the seams are, you'll assume Vault sees

This final article covers the advanced scenarios in AWS incident response — acquiring memory from cloud instances, forensicating containers, understanding the metadata service attack, and making the decision between in-cloud and on-premises analysis. By the end of this series, you have a complete picture of how to investigate any AWS incident from first alert to evidence report. In-Cloud vs. On-Premises Analysis ▸ Recommendation: Always analyse in-cloud first. Download to on-

One of the most powerful capabilities AWS gives you for incident response is the ability to automate it. Unlike on-premise environments where IR automation requires complex SOAR platforms, AWS has native services that can trigger forensic actions the moment a threat is detected — no human in the loop required for the initial containment and evidence preservation steps. Lambda — Serverless Functions for DFIR Automation AWS Lambda lets you run code without managing any servers.