Why should cloud evidence be preserved as soon as possible

Cloud evidence can be temporary. Audit logs may be retained only for a limited period; accounts can be disabled or deleted; retention policies may remove data; and users can continue modifying information.

Preserving relevant cloud evidence as soon as an incident is identified can significantly improve the evidence available for later investigations.