Cloud systems have to deal with massive amounts of distributed, volatile data which makes forensic investigations difficult. Using the NIST reference architecture, a system is devised to proactively capture forensic data ...