Cloud and SaaS forensics

01Scope

Identity and sign-in logs: interactive and non-interactive sign-ins, MFA, conditional access, risky events
Unified audit logs: mailbox access, inbox rules, file access, sharing, downloads, admin changes
Preservation: litigation hold, retention policies, eDiscovery exports and their hashes
IaaS: virtual machine snapshots, storage access logs, API activity trails, key usage
Third-party OAuth applications and their consented permissions

Was the account accessed from an unexpected location or client, and when?
Were inbox rules, forwarding or OAuth consents created during the incident window?
Which files were accessed, downloaded or shared externally, and by which account?
Was the data preserved before anyone changed or deleted it?
What was the provider's retention for each log, and what had already expired?

Source	What it yields	Note
Sign-in and audit log exports (CSV/JSON) from the admin interface or API	Account, time (UTC), IP, user agent, operation, target object, result	Export the full period with all columns; hash the export; record the query and the account used to run it.
Mailbox and drive exports (PST/EML/MBOX, files with metadata)	Content, headers, version history, sharing links	Exports re-wrap content; keep the original internet headers and the provider's item identifiers.
Hold and retention configuration at the time of preservation	Evidence that content could not be altered after a date	Screenshot and export the policy; note the account and time that applied it.
IaaS activity trails and snapshots	API calls, console logins, key creation, instance and storage changes; disk images of VMs	A snapshot is an image: hash it, and treat it with the disk forensics procedure.

Preserve first, under written authority
Apply holds, extend retention, and export logs for the full available window before any remediation. Document who authorised access to the tenant and under which role.
Build the identity timeline
Sign-ins by account, with IP, client, MFA result and location estimate, against the account's own baseline. Distinguish interactive from service sign-ins.
Follow the operations, not only the logins
Inbox rule creation, mailbox delegation, file downloads, sharing changes, OAuth consent, admin role changes: each is an audited operation with an actor and a target.
Hash and catalogue every export
Exports are the evidence. Record file name, size, hash, the query that produced it, the account and the time; store them with the chain-of-custody record.
Report provider limits as findings
If a log was not enabled, had expired or is only available in a higher licence tier, say so with the provider's documentation cited.

The library records behind this area:

Audit log time stamps are UTC but exported CSVs may be reformatted by a spreadsheet application; keep the raw export.
Provider location estimates for an IP are not evidence of where a person was.
Legacy authentication and application tokens can bypass MFA; absence of an MFA prompt does not mean the login was legitimate.
Remediation (password reset, token revocation) itself generates log entries; separate responder activity from attacker activity.
Default retention is often 90 days or less; a late request returns nothing, and that absence must be documented.

Tenant, services, licence tier, which logs were enabled and their retention at the time.
Who exported what, when, with which query, and the hash of each export.
The identity timeline and the operations timeline with log source and record identifier per row.
Explicit gaps: expired logs, disabled auditing, licence limits.

Was a hold applied before remediation, and is the export hashed and catalogued?
Which logs were not available, and is that stated with the provider's retention documentation?
How were responder actions separated from attacker actions in the timeline?
Does the report treat IP location as an estimate?