This module trains digital forensic investigators to identify the correct evidentiary sources in cloud environments. You will learn to map specific technical artifacts to the corresponding AWS logging services required for a complete chain of custody and forensic timeline.

CHFI (312-49) Digital Forensics Simulation

Investigation Scenario

You are conducting a digital forensics investigation for an organization hosting its web infrastructure on Amazon Web Services (AWS). A Linux web server (EC2 instance) exhibits signs of compromise. Preliminary timeline analysis suggests an unauthorized SSH connection was established to the instance over port 22 between 03:00 UTC and 04:00 UTC on the previous day. To correlate the attack timeline and identify the threat actor's origin infrastructure, you must obtain network telemetry data detailing the connection parameters.

Evidence Collected

[Investigator Notes]
Target System: EC2 Instance (i-0abcd1234efgh5678)
OS Image: Amazon Linux 2 (ami-0123456789abcdef0)
Attached ENI: eni-0987654321fedcba0
Subnet: subnet-0123456789abcdef0
VPC: vpc-1a2b3c4d5e6f

[Incident Constraints]
* SSH daemon logs (auth.log / secure) on the instance were wiped by the attacker.
* Requirement: Reconstruct network connection logs (Source IP, Dest IP, Port, Bytes transferred) independent of the host OS.

Question

During a cloud-forensics investigation in AWS, an analyst needs to identify which IP addresses were used to access an EC2 instance via SSH. Which AWS service provides logs of network traffic flow, including source and destination IP addresses?

Forensic Hint: Think about the difference between Control Plane logs (API calls to manage infrastructure) and Data Plane logs (actual IP traffic hitting the network interfaces).

Expert Analysis

1. What evidence shows:

The host-based logs (auth.log/secure) have been destroyed (anti-forensics). The investigator must rely on network-level telemetry attached to the Elastic Network Interface (ENI: eni-0987654321fedcba0) to determine the source IP connecting to TCP port 22.

2. Forensic Stage:

Data Collection & Analysis.

3. Why correct answer is correct:

A. VPC Flow Logs capture raw IP traffic information going to and from network interfaces in a VPC. A standard flow log record contains the source IP, destination IP, source port, destination port (e.g., 22), protocol, and action (ACCEPT/REJECT). This is the exact forensic artifact required to identify the origin IP address of an SSH connection.

4. Why others are wrong:

B. AWS CloudTrail: Records AWS API calls and management events (Control Plane). It tracks *who* provisioned or stopped an EC2 instance, but it does *not* capture OS-level TCP/IP payloads or connections like an SSH session.
C. Amazon CloudWatch: A monitoring and observability service. While CloudWatch Logs can *store* VPC Flow Logs, CloudWatch itself is the repository, not the service that natively generates the network traffic flow data.
D. AWS Config: Evaluates and records configuration changes to AWS resources (e.g., tracking changes to Security Group rules). It does not monitor network traffic flow.

5. Real-world forensic action:

An investigator would access the VPC Flow Logs (often queried via Amazon Athena or CloudWatch Logs Insights) and run a query filtering for the specific ENI (`interface-id="eni-0987654321fedcba0"`) and destination port (`dstport=22`), looking for `action="ACCEPT"` during the timeframe of 03:00 to 04:00 UTC.

6. MINI LESSON: Cloud Artifact Interpretation

In cloud forensics, the Principle of Locard's Exchange still applies, but artifacts are shifted to hypervisor and fabric logs. When host-level evidence (like filesystem logs or memory) is compromised or wiped, investigators must pivot to infrastructure-level telemetry (VPC Flow Logs). Maintaining an understanding of the "Chain of Logs" (where data originates vs. where it is stored) is critical for authenticating digital evidence.

Ready to advance your digital forensics expertise?

Practice with hundreds of realistic scenarios covering malware analysis, memory forensics, and network investigations.

Explore more CHFI simulations