CHFI (312-49) Digital Forensics Simulation

Learn to analyze cloud-native forensic artifacts. This simulation tests your ability to identify threat actor origins using structural metadata within AWS audit logs.

Investigation Scenario

A financial institution utilizing a hybrid cloud architecture experienced a sudden disruption in data access controls. An unauthorized deletion of a critical IAM policy governing access to a highly sensitive S3 bucket (containing customer PII) was executed. The incident was flagged by the SIEM aggregating CloudTrail logs.

As the primary digital forensic investigator responding to the incident, your immediate objective is to establish the origin of the anomalous activity to identify the threat actor and isolate the compromised vector.

Evidence Collected

You have acquired the raw CloudTrail JSON log file covering the timeframe of the incident. Hash verification (SHA-256) confirms log integrity matching the centralized S3 logging bucket hash.

Artifact: cloudtrail-events-20260410.json (Excerpt)

{
  "Records": [{
    "eventVersion": "1.08",
    "userIdentity": {
      "type": "IAMUser",
      "principalId": "AIDAJ45Q7Y6EZEXAMPLE",
      "userName": "admin-temp"
    },
    "eventTime": "2026-04-10T05:22:15Z",
    "eventSource": "iam.amazonaws.com",
    "eventName": "DeletePolicy",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "198.51.100.44",
    "userAgent": "aws-cli/2.0.0 Python/3.7.4 Linux/5.4.0-1045-aws",
    "requestParameters": {
      "policyArn": "arn:aws:iam::123456789012:policy/PII-Access-Policy"
    }
  }]
}

Question

During a cloud-forensics investigation in AWS, an analyst needs to identify the source IP address of a user who deleted an IAM policy. Which field in the AWS CloudTrail log entry for the "DeletePolicy" event should the analyst look at?

Forensic Hint: Review the JSON key structures. Look for the attribute specifically designated for network origin points (Layer 3 of the OSI model) rather than user characteristics, parameters, or application endpoints.

Expert Analysis

What evidence shows: The collected JSON log is an AWS CloudTrail record documenting an API call to the IAM service. It contains metadata mapping the Who (`userIdentity`), What (`eventName`, `requestParameters`), When (`eventTime`), and Where (`sourceIPAddress`).
Identify forensic stage: Analysis Phase (specifically Log Parsing and Correlation).
Why correct answer is correct: (A) sourceIPAddress is the exact, standard schema field AWS uses to record the IPv4 or IPv6 address from which the API request originated. Identifying this is the primary step in tracing network attribution.
Why others are wrong:
- userAgent (B) dictates the client software (browser, CLI, SDK) making the request, which is easily spoofed and does not provide routing origin.
- requestParameters (C) details the target of the action (the policy ARN being deleted), not the source.
- userIdentity (D) shows the authenticated credentials (IAM user, role), but an attacker may be using stolen credentials from an unauthorized location.
Real-world forensic action: An investigator would parse the CloudTrail logs utilizing tools like Amazon Athena, executing SQL queries to filter `WHERE eventName='DeletePolicy'`, extract the `sourceIPAddress`, and perform geographic/threat intelligence lookups to confirm if the IP represents an IoC (Indicator of Compromise) or an anomalous location.

MINI LESSON: Cloud Log Integrity
In digital forensics, logs are only as useful as their admissibility and integrity. CloudTrail provides a feature called Log File Validation. When enabled, AWS delivers a digest file containing a SHA-256 hash of the log file and a digital signature. During the Preservation and Examination phases, an investigator must computationally verify these signatures to prove the chain of custody and guarantee the logs were not modified or deleted by the threat actor post-incident.

Ready to analyze more digital evidence?

Explore more CHFI simulations