Cloud SecurityEP 12
11 Jul 2026
Cloud Forensics and Incident Response
Unit 6 of the Cloud Security course in audio form. The hardware write blocker is a museum piece — but investigators are still catching cloud criminals. This episode traces exactly how: from CloudTrail API attribution and STS role-chaining analysis, to the forensic goldmine hidden inside local SQLite databases left behind by Dropbox and Google Drive. Covers S3 exfiltration, cryptojacking, C2 on cloud IPs, volatile memory loss, multi-tenant contamination, jurisdictional complexity, and how a deleted.dbx file can mathematically prove possession of stolen data even after CCleaner has run.
0:00 / 0:00
EpochZero Tech Talks: Cloud Forensics and Incident Response
Transcript
Conversation between Alex and Maya
Alex (left)Maya (right)
Alex
So we are looking at a really fascinating stack of research papers and incident response case studies today, all covering Unit 6, which is cloud forensics.
Maya
Yeah.
Alex
And it is a wild field right now.
Maya
It really is.
Alex
I mean, we are extracting the exact technical loopholes that investigators use to catch threat actors in these environments where, you know, physical servers are essentially an illusion.
Maya
And honestly, as someone who designs cloud infrastructure for clients, I spend an absurd amount of time thinking about perimeter security.
Alex
Oh, absolutely.
Maya
The perimeter is everything in architecture.
Alex
Right.
Maya
I picture these massive windowless data centers, right, surrounded by concrete bollards and biometric scanners, armed guards.
Alex
It is basically a fortress.
Maya
And for the longest time, the digital forensics world relied entirely on that physical reality.
Alex
They really did.
Maya
Like if a crime happened, an investigator.
Alex
An investigator just found the physical server, walked into the cage and pulled the hard drive.
Maya
Golden age of the hardware write blocker.
Alex
Exactly.
Maya
It was a very comforting, tangible process.
Alex
You secure the perimeter, you physically pull the drive and you slap a hardware controller on it.
Maya
Physical piece of hardware.
Alex
Right.
Maya
A physical block that mathematically guarantees no new data can be written to the disk.
Alex
And then you just start making your pristine forensic images.
Maya
It was incredibly clean.
Alex
But then, you know, enterprise architecture moved to the cloud.
Maya
And I just have this hilarious kind of dark.
Alex
Image in my head of a traditional old school forensic investigator marching up to an AWS facility in northern Virginia.
Maya
Oh, I have seen guys who actually wish they could still do this.
Alex
Right.
Maya
So they're standing there.
Alex
They are holding a screwdriver and a Pelican case with a hardware write blocker.
Maya
And they are demanding to pull, quote unquote, the hard drive.
Alex
Just going me to the hard drive.
Maya
Yeah.
Alex
And the security guard just stares at them because the specific data they are looking for is currently sharded across, I don't know, 10,000 virtualized nodes dynamically shifting between server racks every single millisecond.
Maya
I mean, the screwdriver is completely useless.
Alex
It is entirely obsolete.
Maya
You might as well bring a hammer.
Alex
And that brings us really to the mission for today's deep dive.
Maya
Let's get into it.
Alex
The official definition of cloud forensics highlights that exact operational shift.
Maya
It is the science of investigating and maintaining a strict.
Alex
Legal chain of custody in environments where you have absolute 100 percent zero physical control over the underlying infrastructure.
Maya
Zero physical control.
Alex
Zero.
Maya
See, as an architect, I love that because it means my clients do not have to worry about hardware failures.
Alex
The hypervisor just abstracts all of that away, which is great for uptime.
Maya
Right.
Alex
But for you as an investigator who is trying to build a timeline of a crime, I mean, I have to imagine it is a total nightmare.
Maya
It is definitely a challenge.
Alex
So today for everyone listening.
Maya
We are going to unpack exactly what threat actors are doing in this untouchable space and more importantly, how you catch them anyway, because we are catching them.
Alex
You are catching them despite my architecture actively getting in your way.
Maya
We certainly are.
Alex
But the landscape of the crime has completely changed.
Maya
I mean, we are dealing with a massive modern cloud crime wave right now.
Alex
Yeah, it's not just defacing websites anymore.
Maya
Not at all.
Alex
Attackers are exploiting the core automated capabilities of cloud technology.
Maya
Right.
Alex
Yeah.
Maya
And they are exploiting the technology itself.
Alex
So let's get specific on the mechanics here.
Maya
What does a cloud crime actually look like right now?
Alex
Why is it so hard to spot?
Maya
Well, a primary example is massive S3 bucket exfiltration.
Alex
OK.
Maya
Object storage.
Alex
Right.
Maya
And this isn't just someone downloading a few files manually.
Alex
Attackers find a misconfigured storage bucket.
Maya
Maybe an admin accidentally left an IAM policy with a wildcard on the get object permissions.
Alex
Oh, the dreaded asterisk.
Maya
I see that all the time.
Alex
Exactly.
Maya
And they use automated scripts to do that.
Alex
And they use automated scripts to quietly drain terabytes of sensitive customer data.
Maya
Right.
Alex
They will just use the AWS command line interface and run a sync command.
Maya
They fire off list bucket API calls and they are automatically paginating through millions of objects in the background.
Alex
Before a billing alert even has time to trigger.
Maya
Exactly that.
Alex
And speaking of billing, we are seeing really aggressive crypto jacking.
Maya
Oh, I hate this one.
Alex
Yeah.
Maya
Instead of stealing your data, they steal your compute power.
Alex
Which gets expensive fast.
Maya
Very fast.
Alex
But they are smart.
Maya
They are smart about it now.
Alex
They don't just spin up the most expensive instances and set off all the CloudWatch alarms.
Maya
Right.
Alex
They fly under the radar.
Maya
Yeah.
Alex
They might hijack hundreds of lower cost spot instances or they specifically target GPU optimized clusters.
Maya
And then they throttle their cryptocurrency mining scripts to stay just underneath standard anomaly detection thresholds.
Alex
So they keep the CPU utilization at like 80 percent.
Maya
So it doesn't look like an attack.
Alex
Exactly.
Maya
They are minting Monero on your dime.
Alex
And.
Maya
Incredibly often, we see attackers using legitimate cloud infrastructure to host their own command and control servers, their C2 servers.
Alex
Oh, that is remarkably clever.
Maya
That is a huge headache.
Alex
Because if they host their C2 server on AWS or Azure and they launch an attack on another target from that server, the target's firewall just sees incoming traffic from a known, trusted Amazon IP address.
Maya
It looks like perfectly legitimate API traffic.
Alex
But investigating that.
Maya
I mean, we have to talk about the hurdles here.
Alex
Because as an architect, I know how I build these systems.
Maya
And the first major forensic hurdle just has to be extreme volatility.
Alex
The volatility is staggering.
Maya
Yeah.
Alex
I mean, traditional forensics relies entirely on a static crime scene.
Maya
A frozen snapshot.
Alex
Right.
Maya
You freeze the machine.
Alex
You capture the volatile memory, the RAM, and you analyze it.
Maya
But the cloud is defined by its elasticity.
Alex
Right.
Maya
I mean, I build auto scaling routes specifically so that if a server gets bogged down or if it starts acting erratically, the infrastructure just stops.
Alex
And the cloud just assumes it is unhealthy.
Maya
And it kills it.
Alex
It ruthlessly terminates it and spins up a fresh, clean clone.
Maya
It is literally a feature.
Alex
It is a great feature for you.
Maya
But there is this very dark, geeky humor in the security world about this.
Alex
Yeah.
Maya
I have literally heard of incident responders sitting at their desks, practically in tears, watching an automated script terminate an infected virtual machine just three seconds before they could hit enter on their own script to capture the RAM.
Alex
Yes.
Maya
The entire crime scene just evaporates.
Alex
It literally incinerates itself.
Maya
So all those volatile artifacts like the active network connections, the running processes, the decryption keys held in memory, they are just gone forever.
Alex
Gone forever.
Maya
And even if we do manage to freeze a machine in time, we run into the second major challenge, which is multi-tenancy isolation.
Alex
Because you were sharing the physical hardware?
Maya
Exactly.
Alex
In the cloud, your virtual machine is sitting on the same physical hypervisor as maybe a Fortune 500 bank.
Maya
Or a major health care provider.
Alex
So you cannot just image the whole physical drive.
Maya
It is impossible.
Alex
If I somehow got a judge to sign a warrant to image the underlying physical disk array at an AWS data center, I would be vacuuming up the proprietary, heavily regulated data of hundreds of completely unrelated companies.
Maya
That's a massive risk for tenant contamination.
Alex
It ruins the integrity of the investigation instantly.
Maya
Oh.
Alex
And it opens up a colossal legal liability.
Maya
Which honestly gets exponentially worse when you look at the global architecture.
Alex
Right.
Maya
Well, the jurisdictional issues.
Alex
Yeah.
Maya
Because even if you somehow navigate the liability of tenant contamination on a single server, that server isn't just sitting in one place.
Alex
If my client is using a global content delivery network, their data is actively distributed.
Maya
It is sharded across servers in Tokyo, Frankfurt, and Sao Paulo simultaneously.
Alex
Which introduces a complete jurisdictional maze.
Maya
How do you even handle that?
Alex
Well, if the data is sharded across three different sovereign nations.
Maya
Which countries data localization laws apply, who do you actually serve the warrant to?
Alex
Right.
Maya
Do you need international cooperation treaties just to get a server log?
Alex
Sometimes.
Maya
Yes.
Alex
Yeah.
Maya
And it slows investigations to an absolute crawl.
Alex
Okay.
Maya
But let's be realistic here.
Alex
Look at what we just established.
Maya
If the virtual machine is ephemeral and incinerates itself, and the hardware is multi-tenant, so you cannot pull the physical disk, and the data is scattered across international borders.
Alex
It sounds bad.
Maya
Traditional forensics is dead in the water here.
Alex
Architecturally, you are completely locked out of the physical layer.
Maya
So where does an investigator even pivot when the hardware is entirely off limits?
Alex
We pivot straight to the control plane.
Maya
We just stop worrying about the physical hardware entirely.
Alex
The physical drive is dead to us.
Maya
We shift our entire focus to the API calls.
Alex
Okay.
Maya
So you are moving to the central management layer, which makes complete sense.
Alex
In AWS, the ultimate surveillance camera for those API calls is a service called CloudTrail.
Maya
It's essentially the backbone of modern cloud forensics.
Alex
It really is.
Maya
I mean, for those listening, every single time a user or an automated script does anything in an AWS account, whether they spin up an EC2 instance, change a security group firewall rule, or even just list the contents of an S3 bucket.
Alex
That action is an API call.
Maya
Right.
Alex
And CloudTrail records it.
Maya
It generates a perfect chronological JSON log of who did what, when they did it, the parameters they used, and what IP address the request originated from.
Alex
But here is the fatal flaw.
Maya
If you are only looking at the surface level of those logs.
Alex
I pose this critical question to incident response teams all the time.
Maya
How do you attribute an attack when the IP address logged in CloudTrail belongs to the cloud provider itself?
Alex
Oh.
Maya
Right.
Alex
Because of what we talked about earlier.
Maya
Exactly.
Alex
If an attacker is using an AWS C2 server to attack another AWS service, the IP address just resolves back to Amazon.
Maya
So IP attribution basically becomes useless.
Alex
Precisely useless.
Maya
Oh.
Alex
So we have to move beyond IP attribution and get deep into IAM parsing, identity and access management.
Maya
Okay.
Alex
We are no longer tracking where the network signal came from.
Maya
We are tracking the specific digital identity that authorized the action.
Alex
And threat actors are incredibly adept at manipulating IAM roles to hide their tracks.
Maya
Yes.
Alex
Specifically through the AWS Security Token Service, or STS.
Maya
Yeah.
Alex
Let's break down how they abuse the Assume Role API.
Maya
Because this is a classic architecture.
Alex
That they have turned into a weapon.
Maya
It is a brilliant exploitation of a required feature.
Alex
Legitimate developers and applications use the STS Assume Role function so they do not have to leave permanent hard-coded access keys lying around in their source code.
Maya
Which is a huge security risk.
Alex
Right.
Maya
So instead, an application asks the Security Token Service for a temporary, limited privilege set of security credentials.
Alex
And STS responds with an access key, a secret key, and a session token that automatically expires after a set duration.
Maya
Usually somewhere between 1 and 12 hours.
Alex
Which is standard security practice.
Maya
We enforce that strictly.
Alex
So if a token is stolen, it becomes useless quickly.
Maya
It's great practice until an attacker compromises an initial, low-level account.
Alex
Ah, the initial breach.
Maya
Right.
Alex
Maybe they find an exposed set of developer keys on GitHub.
Maya
Or they exploit a vulnerability in a web-facing EC2 instance that has a basic instance profile attached to it.
Alex
And once they are in?
Maya
Once they are in, they immediately use that compromised identity.
Alex
To call the Assume Role API.
Maya
They generate their own temporary security credentials.
Alex
Perhaps escalating their privileges to a slightly more powerful role.
Maya
Okay.
Alex
Then, they use that temporary role to assume another role.
Maya
Wow.
Alex
They are chaining the roles together.
Maya
Exactly.
Alex
They create a deeply nested chain of temporary identities.
Maya
So by the time they actually execute the malicious action, like deleting a database or exfiltrating logs.
Alex
They are using a token that is four or five layers removed from the original compromised account.
Maya
That is wild.
Alex
Yeah.
Maya
So if an investigator is just looking at the data.
Alex
If an investigator is just looking at the final malicious API call in the JSON log.
Maya
It is incredibly difficult to trace that specific session token backward through time.
Alex
To figure out how they initially breached the perimeter.
Maya
Yes.
Alex
Stitching that back together must be a total nightmare.
Maya
You have to meticulously parse gigabytes of JSON.
Alex
Matching the specific session token IDs across multiple assumed roles before the timestamps expire.
Maya
It takes a lot of automated scripting.
Alex
But wait, let me ask you this.
Maya
If these logs are purely digital and the attacker has managed to escalate to administrative access.
Alex
Couldn't they just alter the CloudTrail logs to cover their tracks?
Maya
They absolutely try.
Alex
Like just delete the JSON files.
Maya
How do you actually prove in a court of law that the logs you are analyzing are authentic?
Alex
That is where the strict chain of custody comes into play in a zero physical control environment.
Maya
Secure collection is paramount.
Alex
We do not just download the logs to a flash drive.
Maya
Right.
Alex
We utilize architectural features.
Maya
That automatically encrypt the logs at rest.
Alex
And more importantly, we immediately lock them down using cryptographic hashing.
Maya
Okay.
Alex
Hashes.
Maya
Specifically MD5 and SHA hash algorithms at the exact point of collection.
Alex
So you calculate a unique mathematical signature for that exact log file the very moment it is generated.
Maya
We do.
Alex
Because if the attacker or even a careless investigator alters a single comma or changes one timestamp in that massive JSON file.
Maya
The resulting MD5 or SHA hash will completely change.
Alex
It will not match.
Maya
It will not match at all.
Alex
So by comparing the hash generated at the time of collection with the hash presented in court.
Maya
We can mathematically prove to a judge that the evidence is pristine.
Alex
That it has not been tampered with since the second it was created.
Maya
Exactly.
Alex
Okay.
Maya
So you have the control plane locked down.
Alex
You are tracking the assumed roles through the STS chaining.
Maya
You are hashing the JSON logs to guarantee integrity.
Alex
We try our best.
Maya
But let me introduce a massive architectural blind spot.
Alex
Oh, I love these.
Maya
Go ahead.
Alex
If an attacker has stolen credentials and is constantly assuming temporary roles.
Maya
It is basically like a thief using a stolen hotel key card that generates temporary master keys.
Alex
Right?
Maya
Good analogy.
Alex
They are walking the digital halls invisibly.
Maya
But what if they don't walk out the front door?
Alex
What do you mean?
Maya
What if they grab the sensitive data but instead of using an AWS service to move it out of the network.
Alex
Which CloudTrail would definitively see and log.
Maya
They use a third party service.
Alex
Wow.
Maya
Like what if they install the Dropbox or Google Drive desktop client on a compromised virtual machine.
Alex
And they just drag and drop the stolen database into a synced folder.
Maya
Yep.
Alex
The data leaves the AWS environment entirely.
Maya
They bypass our CloudTrail logs completely.
Alex
So how do you track them then?
Maya
That scenario right there is the absolute pivot point of modern incident response.
Alex
Really?
Maya
Yes.
Alex
When they move the data to a third party cloud application like Dropbox or Google Drive.
Maya
We use a massive forensic trade secret to bypass the cloud entirely.
Alex
Okay.
Maya
I am genuinely curious.
Alex
How do you bypass the cloud?
Maya
Well.
Alex
If you are investigating a suspect.
Maya
And you know they are using Dropbox or Google Drive to exfiltrate data.
Alex
The absolute worst thing you can do is alert the cloud provider.
Maya
Wait.
Alex
Really?
Maya
You don't ask Google for the logs?
Alex
No.
Maya
You do not send a subpoena to Google right away.
Alex
And you absolutely do not try to guess the suspect's password.
Maya
And log into the web interface.
Alex
Oh.
Maya
I guess because if you log into the web interface.
Alex
You change the last accessed timestamp.
Maya
Exactly.
Alex
You alter the cloud state.
Maya
And destroy the forensic integrity of the account.
Alex
That is the first reason.
Maya
You contaminate the evidence.
Alex
But more importantly.
Maya
If the suspect is actively monitoring their account sessions.
Alex
You tip them off.
Maya
Oh.
Alex
The moment they see an unknown login.
Maya
They will wipe the cloud storage instantly.
Alex
So what do you do?
Maya
So.
Alex
We do not look at the cloud server.
Maya
We perform forensics.
Alex
On the suspect's local endpoint.
Maya
The physical machine.
Alex
Yes.
Maya
We go to the physical desktop.
Alex
The laptop.
Maya
Or the specific virtual machine they were operating from.
Alex
Wait.
Maya
But the data is in the cloud?
Alex
That is the whole architectural point of a service like Dropbox.
Maya
Is it though?
Alex
I mean.
Maya
Yes.
Alex
Think about how those applications actually function.
Maya
To make these services work offline.
Alex
And to sync massive files quickly.
Maya
Without re-downloading them every single time you open a folder.
Alex
The desktop clients leave behind an absolute treasure trove of hidden data on the local operating system.
Maya
Oh wow.
Alex
Yeah.
Maya
We specifically target the hidden SQLite sync databases left behind by these sync clients.
Alex
Those SQLite databases.
Maya
It is a highly technical, completely invisible backdoor into their entire cloud activity.
Alex
Let's break this down technically.
Maya
Because SQLite is just a lightweight file-based database format.
Alex
Right?
Maya
Exactly.
Alex
It doesn't require a background server process.
Maya
It just writes directly to a file.
Alex
So.
Maya
What are we actually looking for on a local Windows machine if the attacker used say Google Drive?
Alex
Let's get granular.
Maya
For Google Drive we are hunting for specific SQLite database files buried deep in the user profiles.
Alex
The first major one is called syncconfig.db.
Maya
Syncconfig.db.
Alex
Okay.
Maya
This is vital because it contains a specific table that actually stores the user's email address in plain text.
Alex
Wow.
Maya
So instantly you have the exact account name they are using for the exfiltration.
Alex
Right.
Maya
So you can apply the physical machine to the specific digital identity right away.
Alex
Yes.
Maya
But the real goldmine is a secondary file called snapshot.db.
Alex
Snapshot.db.
Maya
What does that do?
Alex
This SQLite database contains multiple tables.
Maya
But forensic investigators focus heavily on the local entry table.
Alex
This table maintains a precise running record of every local file's location, its cryptographic checksum, and its exact size and bytes.
Maya
Wait.
Alex
Even if the file is currently sitting on a server in a Google data center somewhere, the local Windows machine maintains a highly detailed index of it.
Maya
A perfect, continuously updated index.
Alex
That is crazy.
Maya
It is.
Alex
Now let's look at Dropbox because Dropbox forensic analysis has been heavily researched and the local artifacts are incredibly persistent.
Maya
Okay.
Alex
Lay it on me.
Maya
We navigate into the user's directory, specifically the AppData folder.
Alex
Oh, the AppData folder.
Maya
The classic hidden by default directory in Windows.
Alex
Always.
Maya
Attackers always forget about it.
Alex
Inside that folder, we find a series of .dbx files.
Maya
These are just encrypted SQLite databases.
Alex
Okay.
Maya
So they encrypt them at least.
Alex
They do.
Maya
But we use known decryption tools to open them right up.
Alex
First, we look at config.dbx.
Maya
This gives us the unique host ID of the machine and the user's email.
Alex
Next, we parse a massive file called filecache.dbx.
Maya
File cache.
Alex
What exactly is stored in the file cache?
Maya
Literally everything.
Alex
Specifically inside the file journal table.
Maya
It shows us the server paths, where the data is stored in the remote cloud, the local file names on the hard drive, and crucial metadata.
Alex
What kind of metadata?
Maya
The precise UNIX timestamps for when the file was created and when it was last modified.
Alex
We can build a perfect second-by-second timeline of exactly when the attacker moved the stolen AWS data into the Dropbox folder.
Maya
Wait, so let me get this straight.
Alex
As an architect, I'm spending all my time trying to secure the AWS perimeter.
Maya
Right.
Alex
I am locking down IAM roles.
Maya
I am ensuring CloudTrail is hashing logs, setting up alerts, but the attacker's fatal flaw isn't in the cloud at all.
Alex
Not at all.
Maya
It is the fact that their local Windows OS is completely selling them out.
Alex
Exactly.
Maya
They think they are operating in this untouchable, ephemeral cloud space, but their local operating system is obsessively logging a receipt of the crime in the AppData folder.
Alex
It is logging it, and better yet, it is doing the mathematical heavy lifting for us.
Maya
Oh, so?
Alex
For example, there is another SQLite database in that Dropbox folder called sigstore.dbx.
Maya
This database stores the actual hash values of the synced files.
Alex
Oh, that is devastating for an attacker.
Maya
It really is.
Alex
So you don't even need to recover the original file to prove what they stole?
Maya
Nope.
Alex
If an attacker steals a highly classified document, and we already know the hash of that classified document, we just look in their local sigstore.dbx file.
Maya
Yeah.
Alex
If the hashes match, we have absolute mathematical proof they possess that specific file and synced it to their Dropbox.
Maya
Is irrefutable evidence in court.
Alex
Wow.
Maya
But here is the absolute best artifact in the entire Dropbox directory.
Alex
It is a database simply called deleted.dbx.
Maya
Wait, the client keeps a database of what you delete?
Alex
It absolutely does.
Maya
Threat actors are generally smart enough to know they shouldn't leave stolen, highly sensitive data sitting on their local hard drive.
Alex
Right, that is just asking to get caught.
Maya
So they sync it to the cloud, and then they delete the local file, thinking they have wiped their tracks.
Alex
Thinking they have wiped their tracks.
Maya
They just drag it to the recycling bin and empty it.
Alex
Yeah, or sometimes they even run anti-forensic tools, like CCleaner, to securely scrub their registry and overwrite the empty space on the hard drive.
Maya
Right, completely covering their local tracks so investigators find nothing.
Alex
But the Dropbox desktop client, by its very design, has to remember what was deleted so it can tell the remote cloud server to delete it, or move it to the online trash bin.
Maya
Oh my god.
Alex
The deleted.dbx file contains the cache path.
Maya
The origin path of where the file used to be on the local machine before it was scrubbed.
Alex
And the exact date and time it was added to the deletion queue.
Maya
That is just incredible.
Alex
I mean, an attacker goes through all this trouble.
Maya
They compromise the IAM roles.
Alex
They assume temporary security tokens with STS.
Maya
They chain identities together to evade CloudTrail.
Alex
Very sophisticated stuff.
Maya
Then they dump the data into a third-party application to bypass AWS logging completely.
Alex
And then they securely wipe the local file with a tool like CCleaner.
Maya
It's like an anti-forensics tool.
Alex
They think they are a complete ghost.
Maya
A total ghost.
Alex
And all the while, investigators are just quietly copying a hidden SQLite database from their local AppData folder that provides a fully indexed, timestamped, and cryptographically hashed map of every single thing they did.
Maya
We can completely reconstruct the pristine state of a remote, third-party cloud server just by reading hidden files on a local Windows machine.
Alex
It is brilliant.
Maya
And we do it completely invisibly, without the suspect or the cloud provider ever knowing an investigation is actively happening.
Alex
So, what does this all mean for the big picture of infrastructure security?
Maya
I mean, we started this deep dive talking about the death of the physical write blocker.
Alex
Right.
Maya
The idea that traditional forensics was dead because the hardware was locked away in a multi-tenant, globally distributed fortress.
Alex
But what this investigation shows is that the crime scene didn't disappear.
Maya
Right.
Alex
No, it just changed shape entirely.
Maya
It became highly distributed across multiple layers.
Alex
Yeah.
Maya
If we connect this to the broader architectural picture, the cloud is inherently designed to be resilient, highly available, and synchronized.
Alex
Absolutely.
Maya
And to achieve that resilience, it has to generate logs.
Alex
It has to generate API trails in CloudTrail.
Maya
It has to create local SQLite databases to manage offline syncing and state changes.
Alex
It is the ultimate paradox of the cloud.
Maya
How so?
Alex
Well, it is advertised to users as this invisible, ephemeral, untouchable place.
Maya
But in reality, to make that illusion of invisibility work, the architecture has to leave an indelible, highly trackable digital footprint across both the control plane and the local endpoints.
Alex
Yes.
Maya
You just have to understand the architecture well enough to know exactly where those footprints are hidden.
Alex
The physical hardware write blocker might be a relic of the past, but the data remnants and the digital footprints are very much alive.
Maya
Oh, they are everywhere.
Alex
This has been a massive shift in perspective.
Maya
We have gone from the physical server racks, through the absolute maze of API attribution and STS-IAM parsing, right down to the hidden SQLite databases sitting quietly on a local hard drive.
Alex
It is an endless cat-and-mouse game between attackers and investigators, honestly.
Maya
But as long as distributed systems need to communicate and synchronize data, they will inherently leave a structural trail for us to follow.
Alex
For you listening, I want to leave you with a slightly unsettling thought to chew on today.
Maya
We just spent a lot of time talking about this.
Alex
We just spent all this time discussing how our local laptops and desktops are secretly mirroring the entire history of our supposedly ephemeral cloud activity in hidden, unencrypted, local SQLite databases.
Maya
Which is pretty scary if you think about it.
Alex
It is.
Maya
So look at the phones sitting on your desk or in your pocket right now.
Alex
What other supposedly cloud-only applications, like your secure encrypted messengers, your financial dashboards, your secure photo vaults, what else is actually leaving permanent, highly detailed footprints behind?
Maya
It is definitely a question worth asking the next time your device hits sync.
Alex
It really is.
Maya
Well thank you for joining us on this journey into the architecture and the hidden corners of cloud forensics.
Alex
Keep questioning the infrastructure around you, and we will see you on the next deep dive.
Show Notes
Topics covered in this episode
• The death of the hardware write blocker: traditional forensics assumed physical access to servers — cloud computing shattered that model entirely, with data sharded across thousands of virtualised nodes dynamically shifting between racks every millisecond
• Cloud forensics defined: the science of investigating and maintaining a strict legal chain of custody in environments where investigators have zero physical control over the underlying infrastructure
• Modern cloud crime wave:
- Massive S3 bucket exfiltration via automated AWS CLI sync scripts exploiting wildcard IAM get-object permissions
- Cryptojacking: hijacking GPU-optimised clusters and throttling Monero mining scripts to stay under CloudWatch anomaly detection thresholds (e.g., CPU held at 80%)
- C2 servers hosted on legitimate AWS/Azure infrastructure so target firewalls see trusted Amazon IP addresses — making IP attribution useless
• Three forensic hurdles in cloud environments:
1. Extreme volatility — auto-scaling health checks terminate compromised VMs seconds before investigators can capture RAM, erasing active network connections, running processes, and in-memory decryption keys
2. Multi-tenancy isolation — physical disk imaging is legally impossible because the same array may hold data from hundreds of unrelated enterprises
3. Jurisdictional maze — data sharded across Tokyo, Frankfurt, and São Paulo simultaneously creates a tangle of data localisation laws and treaty requirements
• CloudTrail as the control-plane surveillance camera: every AWS API call — EC2 spin-ups, security group changes, S3 bucket lists — logged as timestamped JSON including identity, parameters, and source IP
• IAM forensics over IP attribution: when an attacker's C2 runs on AWS, the logged IP resolves back to Amazon; investigators must parse identity chains, not network addresses
• STS Assume Role abuse: attackers compromise a low-level account (e.g., exposed developer keys on GitHub), then chain four to five layers of temporary STS credentials to bury the original breach point — by the time the malicious action fires, the session token is completely detached from the initial compromise
• Chain of custody in a zero-physical-control environment: logs are encrypted at rest and hashed with MD5/SHA at the exact moment of collection; a single changed comma flips the hash and proves tampering to a judge
• The third-party bypass: attacker installs Dropbox or Google Drive desktop client on a compromised VM and drags stolen AWS data into a synced folder — CloudTrail never sees this egress
• Why you never log into the suspect's cloud account: changes the last-accessed timestamp, destroys forensic integrity, and tips off the suspect if they are watching active sessions
• Local SQLite forensics — Google Drive artifacts:
- syncconfig.db: stores the user's account email address in plain text, instantly tying the physical machine to the digital identity
- snapshot.db / local_entry table: running index of every file's location, cryptographic checksum, and exact size in bytes — persists even when the file is on a remote Google server
• Local SQLite forensics — Dropbox AppData/.dbx artifacts:
- config.dbx: unique host ID of the machine and the user's email address
- filecache.dbx / file_journal table: server-side paths, local file names, and precise UNIX timestamps for creation and last-modified — builds a second-by-second exfiltration timeline
- sigstore.dbx: hash values of synced files — if the known hash of a classified document matches an entry here, it is irrefutable mathematical proof of possession in court
- deleted.dbx: the attacker's fatal flaw — the Dropbox client must record deletions to instruct the remote server; this database stores the original local path and the exact timestamp the file entered the deletion queue, surviving even after CCleaner scrubs the drive
• The cloud paradox: the same architectural features that make cloud services resilient and always-available (API logs, local sync state databases) create an inescapable, distributed digital footprint across the control plane and every endpoint that ever ran a sync client