Cloud Database Forensics in Practice: Structural Challenges and Investigative Lessons From Azure SQL Database
Jiho Shin, Byoung Hun Moon · IEEE Access · 2025
Cloud database forensics faces fundamental structural challenges that differ from traditional on-premises environments. This study experimentally investigates how three representative recovery techniques—transaction log analysis, data page inspection, and buffer pool analysis—operate under the structural constraints of Azure SQL Database. A controlled deletion scenario was designed in which specific records were removed from a sample table, and the recovery feasibility of each technique was examined using native Structured Query Language (SQL) diagnostic commands. Rather than simply reapplying existing recovery methods, this study demonstrates their structural non-applicability within the Platform as a Service (PaaS)-based cloud environment, thereby establishing empirical evidence of an unexplored forensic limitation. The results show that transaction log analysis remains partially accessible but ephemeral, while page- and memory-based recovery approaches are structurally restricted by the PaaS architecture, making complete reconstruction infeasible. These findings demonstrate that conventional recovery procedures cannot be directly replicated in cloud databases, highlighting the need for new forensic readiness strategies and institutional cooperation between investigators and cloud service providers. The study provides practical evidence of structural non-applicability in cloud forensic procedures and offers policy-level implications for trustworthy digital investigations in cloud environments.