The world is changing and so is the data we need to conduct our investigations. Cloud platforms change how data is stored and accessed. They remove the examiner’s ability to put their hands directly on the systems. Many examiners are trying to force old methods for on-premise examination onto cloud hosted platforms. Rather than resisting change, examiners must learn to embrace the new opportunities presented to them in the form of new evidence sources. FOR509: Enterprise Cloud Forensics and Incident Response addresses today’s need to bring examiners up to speed with the rapidly changing world of enterprise cloud environments by uncovering the new evidence sources that only exist in the Cloud.
FOR509.1: Microsoft 365 and Graph API
FOR509.2: Microsoft Azure
FOR509.3: Amazon (AWS)
FOR509.4: Google Workspace
FOR509.5: Google Cloud
FOR509.6: Multi-Cloud Intrusion Challenge
