Internship← Digital Forensics learning pathDigital Forensics · Module 9 of 10
Cloud and email forensics
Investigate cloud services and emails.
📖 Key ideas
- Cloud evidence lives with providers; use legal requests and provider logs.
- Audit logs (AWS CloudTrail, Microsoft 365 audit) record actions.
- Email headers show routing, sender servers and timestamps.
- SPF, DKIM and DMARC results help detect spoofed email.
- Preserve data quickly due to retention limits.
💡 Real-life example: Email headers are the postmarks on an envelope showing every post office it passed.
Audit logRecord of user/admin actions
Email headerRouting metadata of an email
DKIMEmail signature authentication
Retention periodHow long data is kept