Cloud-Native Evidence Collection

Collecting evidence in cloud environments requires API-driven approaches:
Automated Evidence Collection Script:
import boto3
import json
from datetime import datetime

class CloudForensicsCollector:
    def __init__(self, region='us-east-1'):
        self.ec2 = boto3.client('ec2', region_name=region)
        self.cloudtrail = boto3.client('cloudtrail', region_name=region)
        self.s3 = boto3.client('s3', region_name=region)
        
    def collect_instance_evidence(self, instance_id):
        evidence = {
            'timestamp': datetime.utcnow().isoformat(),
            'instance_id': instance_id
        }
        
        # Instance details
        evidence['instance'] = self.ec2.describe_instances(
            InstanceIds=[instance_id]
        )
        
        # Security groups
        evidence['security_groups'] = self.ec2.describe_security_groups()
        
        # Network interfaces
        evidence['network_interfaces'] = self.ec2.describe_network_interfaces(
            Filters=[{'Name': 'attachment.instance-id', 'Values': [instance_id]}]
        )
        
        # Recent API calls
        evidence['api_calls'] = self.get_recent_api_calls(instance_id)
        
        return evidence
        
    def create_forensic_snapshot(self, volume_id):
        response = self.ec2.create_snapshot(
            VolumeId=volume_id,
            Description=f'Forensic snapshot created at {datetime.utcnow()}'
        )
        return response['SnapshotId']