Forensic Account
Definition
A dedicated cloud account, separate from the production account, that holds shared snapshots, the forensic analysis instance, and the chain-of-custody artefacts. Isolating the analysis prevents attacker IAM from reaching the evidence.
- Purpose
- Isolated cloud account for evidence and analysis
- Contents
- Shared snapshots, forensic analysis instance, chain-of-custody artefacts
- Separation from
- Production account
- Key benefit
- Attacker IAM privileges in production cannot reach evidence
Common questions
Why must the forensic account be separate rather than just using a locked-down folder in the same production account?+
If an attacker has compromised IAM roles or credentials within the production account, they could potentially reach, alter or delete evidence stored in the same account regardless of folder permissions. A genuinely separate account with its own boundary prevents production-side compromise from touching preserved evidence.
How are snapshots and images transferred into the forensic account without exposing them to a compromised environment?+
Cloud providers support sharing a snapshot or disk image directly into another account through account-level permissions, which copies the evidence into the isolated forensic account without granting the source account's compromised credentials any access to the destination.
Does isolating evidence in a forensic account satisfy chain-of-custody requirements on its own?+
It supports chain of custody by limiting who can access the evidence, but formal custody documentation, such as logging who accessed what and when, still needs to be maintained separately; account isolation is a technical control, not a substitute for the documented custody record itself.
Related terms
- CERT-in Direction April 2022
- Direction issued under Section 70B(6) of the IT Act 2000 requiring 6-hour incident reporting, 180-day log retention in India, KYC retention by...
- Control-Plane Log
- A record of management API calls against cloud resources (create, delete, modify, attach IAM role). AWS CloudTrail, Azure Activity Log, and GCP...
- Data-Plane Log
- A record of operations on the data inside a resource: S3 object reads, KMS decrypts, database queries. Off by default in most...
- Service Control Policy
- An AWS Organizations policy attached to an account or OU that constrains what IAM principals inside the account can do. Used in...
- VM Snapshot
- A point-in-time copy of a managed disk taken at the storage layer (EBS, Azure managed disk, GCP persistent disk). Crash-consistent by default;...