Cloud Forensics for Microsoft Azure

Cloud forensics is not "forensics but in the cloud." It's its own discipline, with its own evidence model, its own failure modes, and its own rules about who controls the truth.

Cloud Forensics for Microsoft Azure is a field-ready guide for incident responders, forensic examiners, and cloud security engineers who need to investigate compromises inside Azure environments. Written for practitioners who already understand traditional DFIR and Azure basics, this book skips the introductory material and goes straight to the mechanics that determine what evidence exists, who controls it, and how long it survives before it's gone for good.

Across twelve chapters, you'll learn how to read Azure's control-plane and data-plane logs at depth, trace identity-centric attack chains through Entra ID, acquire forensically sound evidence from VMs, containers, and serverless workloads, investigate storage exfiltration and ransomware, build defensible chain of custody at cloud scale, and construct KQL-driven timelines that hold up under scrutiny. Three fully worked attack scenarios, a phished global administrator, an SSRF-to-exfiltration chain, and a ransomware case, carry the techniques from theory into practice, followed end to end from first alert to final report.

The book closes with the engineering work needed to make an Azure estate forensically ready before the next incident begins, because most Azure investigations fail not from lack of skill, but because the right log was never turned on, the right retention was never set, or the right identity was never audited.

This is the playbook for anyone who has to answer "what happened here" in an environment where the disk is a managed object, the perimeter is an API, and the evidence might evaporate in ninety days.