Cloud evidence lifecycle framework: a six-stage log-centric method for multi-tenant AWS forensic investigations.

The Cloud Evidence Lifecycle Framework (CELF) is a six-stage forensic methodology that is log-centric, and that is designed for use in a multi-tenant Amazon Web Services environment. This replaces the traditional technique for seizing physical evidence today with a focus on configuration-based immutability and cross-service correlation of the evidence. Each stage of the CELF contains tenant boundary validation and log integrity controls, including: Tenant Context Definition, Evidence Surface Identification, Log-Centric Preservation, Structured Evidence Collection, Cross-Service Examination, and Attribution & Isolation Validation. - The CELF is mapped to the native AWS services of CloudTrail, S3 Object Lock, IAM, VPC Flow Logs, AWS Config, and CloudWatch, and aligned with the specific forensic objectives of each service, thereby providing a replicable configuration-level blueprint which is aligned with the guideline provided in NIST SP 800-201. Validation within a controlled two-tenant AWS eu-north-1 environment has demonstrated that all of the API activity to date has been captured, that all of the logs are immutable with respect to the evidence preservation, and that all of the events that have been reconstructed chronologically across the services (without requiring hypervisor access) have been reconstructed.