Forensic investigation conjures thoughts of disk cloning and memory analysis. But investigating cloud services, IdPs and SaaS requires a completely new set of tools, skills, and mindset! This talk will teach attendees how to do that, collecting artifacts from multi-cloud and SaaS, identifying attacks, and providing forensically sound evidence and records to support their conclusions.