Cloud Forensic Tools and Storage: A Systematic Mapping Study

Cloud computing has fundamentally transformed digital forensic investigations by introducing distributed, multi-tenant, and highly dynamic environments where traditional acquisition methods are no longer feasible. The rapid evolution of cloud service models, including IaaS, PaaS, and SaaS, alongside containerised and microservice architectures, has resulted in a fragmented landscape of forensic tools and approaches. This study presents a systematic mapping of cloud forensic tools and storage-related techniques published between 2020 and 2025. Using a structured methodology applied to IEEE Xplore, ACM Digital Library, and ScienceDirect, 12 primary studies were selected from an initial pool of 120 records. These studies were classified according to service models, forensic phases, storage artifacts, and technical challenges. The results show a shift toward log-centric and metadata-driven investigations, particularly in SaaS environments, while traditional disk-based analysis remains limited to IaaS contexts. Emerging areas such as container and ephemeral storage forensics remain underdeveloped. Three major challenges are identified: evidence volatility, data scale, and trust in provider-controlled infrastructures. Although solutions such as automated analysis and Zero Trust models exist, most remain at early stages. The findings highlight the need for cloud-native, scalable, and transparent forensic frameworks to support reliable and legally defensible investigations.