This article describes an infrastructure and workflow process to help teams provide digital evidence that demonstrates a valid chain of custody (CoC) in response to legal requests. This discussion guides a valid CoC throughout the evidence acquisition, preservation, and access processes.
https://learn.microsoft.com/en-us/azure/architecture/example-scenario/forensics/
