Initial commit - 611 cybersecurity skills across all subdomains

skills/performing-cloud-storage-forensic-acquisition/references/standards.md

@@ -0,0 +1,18 @@
+# Standards - Cloud Storage Forensic Acquisition
+
+## Standards
+- NIST SP 800-86: Guide to Integrating Forensic Techniques
+- ISO/IEC 27037: Digital Evidence Collection
+- NIST Cloud Computing Forensic Science Challenges (NISTIR 8006)
+- CSA Cloud Forensics Capability Implementation Guide
+
+## Tools
+- Magnet AXIOM Cloud: Commercial multi-cloud acquisition
+- Cellebrite Cloud Analyzer: SaaS evidence collection
+- kumodd: Open-source proof-of-concept cloud acquisition tool
+- KAPE: Endpoint-based cloud artifact collection
+
+## API References
+- Google Drive API v3: https://developers.google.com/drive/api/v3/reference
+- Microsoft Graph API: https://docs.microsoft.com/en-us/graph/api/resources/onedrive
+- Dropbox API v2: https://www.dropbox.com/developers/documentation/http/documentation

skills/performing-cloud-storage-forensic-acquisition/references/workflows.md

@@ -0,0 +1,33 @@
+# Workflows - Cloud Storage Forensic Acquisition
+
+## Workflow 1: API-Based Remote Acquisition
+```
+Obtain legal authorization and credentials
+    |
+Authenticate via service API (OAuth2 / app credentials)
+    |
+Enumerate all files including shared and trashed items
+    |
+Download file contents preserving metadata
+    |
+Collect revision history and activity logs
+    |
+Hash all acquired files (SHA-256)
+    |
+Generate acquisition log with timestamps
+```
+
+## Workflow 2: Endpoint Artifact Collection
+```
+Identify cloud sync client installations
+    |
+Collect local sync databases (KAPE cloud targets)
+    |
+Parse sync engine databases (OneDrive, GDrive, Dropbox)
+    |
+Identify cloud-only files from metadata
+    |
+Recover cached and deleted files from local storage
+    |
+Correlate local artifacts with API-acquired data
+```