Speed is key: Leveraging the Cloud for Forensic Artifact Collection & Processing
summary
Staged PowerShell collectors (invoke-lr-collection downloads and validates a stager; invoke-triage-collection captures memory then triage artifacts) encrypt outputs with envelope crypto (public key in the script, private key only in cloud) and upload to S3; triage CSVs appear ~10 minutes and full memory ~25 minutes. Pipeline uses CAPE, Volatility/search‑collect, 7‑Zip, EC2 workers and Lambda hooks, produces CSVs + originals for deeper analysis, and enforces auditable case numbers and GDPR switches.
AI-written summary · about
chapters (9)
- 0:00Introduction and context
- 1:02Problem statement
- 5:31Tooling and collection methods
- 10:20Security and encryption
- 12:28Cloud processing architecture
- 17:00API-driven automation
- 20:02Demo and workflow walkthrough
- 24:21Summary and future roadmap
- 27:56Q&A session
related talks
10mLightning Talk: Challenges in Cloud Native Forensics
43mThreat hunting in the cloud
46mDigital Forensics – The Importance of Forensic Triage Images
31mBringing Chronological Context to Disparate Artifacts: Accelerating Digital Forensics
14mDFIR - Don't Forget Your Roots!
43mSimplify and accelerate security for simple storage: Case studies (PRT276)
37mCloud, security, and science converge in a data-driven world (PRT324)
25mBeyond Human Scale: AI and Automation as Force Multipliers in Cyber Threat Intelligence