I recently did a university module on digital forensics and learned a lot about the process, and techniques, of digital forensics investigations.
We didn't actually cover the cloud although I couldn't stop thinking about how it would work. Although we can access the virtual machine image, and all of the files/logs etc on them afterwards, there are a couple of things we don't have access to.
First of all the physical disk (both RAM and the physical hard drive the VM was hosted on), and the network logs, are out of bounds to a user from a remote location. But I was wondering what else there might be that I haven't thought of which would be of use to a forensics investigator?