cloud investigation