What is Cloud and SaaS Forensics?

Cloud and SaaS Forensics involves the forensic collection and analysis of evidence from cloud platforms and software-as-a-service environments, such as Microsoft 365, Google Workspace, AWS, and Azure.

VMGroup collects and correlates evidence from:

• Audit logs (e.g. sign-ins, mailbox access, OAuth grants)

• Storage activity and file access records

• Identity and access events

• Collaboration platforms such as Microsoft Teams, Slack, and Zoom

Our approach supports both technical investigation and regulatory defensibility, ensuring that findings are reliable for legal, disciplinary, and regulatory use.

How does Cloud Forensics support GDPR and Irish regulatory requirements?

VMGroup investigations are designed to align with GDPR and Irish data protection expectations, including:

• Supporting Article 33 and Article 34 breach impact assessments

• Advising on whether notification to the Data Protection Commission (DPC) is required

• Assisting with DPC breach notification submissions, including complex cross-border scenarios where the Irish DPC acts as Lead Supervisory Authority

• Providing practical guidance on EEA data residency, international transfers, and safeguards such as Standard Contractual Clauses (SCCs)

This ensures that cloud investigations support both incident response and compliance obligations.

When is Cloud and SaaS Forensics typically required?

Cloud forensic services are commonly used in incidents such as:

• Business Email Compromise (BEC), including mailbox rule abuse, consent phishing, and OAuth token misuse

• Data leakage from cloud storage, including SharePoint, OneDrive, Google Drive, and Amazon S3

• Insider misuse of access, privilege escalation, or suspicious activity within Azure AD / Entra ID or identity platforms

What deliverables does VMGroup provide?

Clients typically receive:

• A cloud audit timeline showing what happened and when

• A detailed access and activity map across users, systems, and data

• Evidence packages (e.g. PST, EML, SharePoint or Drive exports) with full chain of custody

• Practical recommendations to strengthen identity security, including MFA configuration, conditional access, and privilege management