The invention relates to digital cloud forensics. An embodiment of the present invention applies collection processes and tools to cloud infrastructure as a service to provide a more efficient and faithful representation of evidence. An embodiment of the present invention applies innovative concepts to retrospectively investigate ephemeral instances which may have long since terminated. This innovative process provides organizations a strategy to provide forensic investigations within either a public or private cloud environment.