Question

An investigator at a SaaS customer organization must collect forensic artifacts related to a suspected account compromise. The relevant hypervisor logs, underlying storage snapshots, and network flow data reside entirely within the cloud provider's infrastructure and are not exposed through the customer's tenant console. What is the MOST appropriate first step to lawfully obtain this evidence?

Accepted Answer

Invoke the provider cooperation and data-access terms defined in the cloud contract or SLA, formally requesting the provider preserve and produce the required artifacts

Answer

Deploy a custom agent that scans the hypervisor host directly to extract the logs before they are overwritten

Answer

Issue a subpoena directly to the provider's data center staff to seize the physical drives holding the storage snapshots

Answer

Reconstruct the missing evidence from the customer's own application logs since the provider-side data is inaccessible