Evidence Integrity

Evidence integrity means preserving forensic artifacts and being able to demonstrate whether they have changed since collection. In cloud incident response, these artifacts include operating system logs, application logs, identity and API activity records, network flow records, and captured storage data. Investigators need more than a searchable copy: they need the original records, their provenance, and a reliable account of how they were collected and handled.

Collection should begin before an incident through centrally managed logging. Forward relevant system and application logs away from workloads to a protected destination, ideally in a separate security account or administrative boundary. This reduces the opportunity for an attacker who compromises a workload to erase its history. During an incident, capture additional artifacts before terminating instances or deleting ephemeral resources when operational safety permits. Record the source resource, account, region, collection time, collection method, and responsible identity.

Preserve original files and distinguish them from analysis copies. Parsing, decompressing, normalizing timestamps, or filtering records can change their byte representation even when the underlying information remains useful. Compute a cryptographic hash, such as SHA-256, for each collected file and record it in a protected manifest. Recompute hashes after transfers and before analysis. A matching hash demonstrates consistency with the recorded baseline, but it does not establish who created the file or whether the source was already compromised. Protect or digitally sign the manifest so an attacker cannot simply replace both the artifact and its expected hash.

Storage controls should prevent unauthorized modification and premature deletion. Use narrowly scoped access permissions, versioning, and write-once retention where appropriate. In Amazon S3, Object Lock protects specific object versions; compliance mode prevents deletion of a protected version during its retention period, including by the account root user. Governance mode allows authorized bypass, so it provides a different protection level. A legal hold remains in effect until an authorized principal removes it. These controls protect stored evidence, but they do not prevent attackers from disabling future collection or submitting misleading records.

For example, after suspected credential theft, responders can preserve CloudTrail records alongside host authentication logs and application request logs in a protected evidence repository. When CloudTrail log file integrity validation is enabled, its signed digest files support checking the integrity of delivered log files. Enabling this feature creates validation material; investigators must actually run validation to check the records. It does not validate arbitrary application logs or prove that every relevant event was captured.

Maintain a chain-of-custody record covering collection, access, transfers, and transformations. Preserve timestamps and timezone information, and account for clock skew and delivery delays when correlating events. Monitor missing log delivery and protect logging configuration changes. A trustworthy timeline requires collection coverage as well as unchanged files.

The main trade-offs are storage cost, retention obligations, privacy exposure, and restrictions on deletion. Excessively short retention can destroy evidence before an incident is discovered, while excessive retention increases cost and exposure of sensitive data. Encryption protects confidentiality but does not by itself establish forensic integrity. Preserve access to encryption keys throughout the retention period because immutable encrypted objects become unusable if their keys are destroyed. Finally, integrity controls support defensible investigations; they do not automatically establish legal admissibility or guarantee that a compromised source reported truthful events.