Which would be the ideal system for conducting analysis during cloud investigations?

Using the organization's service account risks leveraging credentials that may themselves be compromised, which could taint the investigation and expose it to the attacker.

An on-premise system with limited network connectivity cannot effectively reach cloud APIs, storage, and logs needed for a thorough cloud investigation.

On-premise systems introduce data transfer and format challenges when handling cloud-native evidence, and increase the risk of incomplete or altered artifact collection.

A cloud-based forensics system minimizes data transfer issues, preserves chain of custody for cloud-native artifacts, and avoids introducing latency or format incompatibilities. Using an independent service account is critical because the organization's accounts may be compromised or tainted by the incident under investigation, which could contaminate evidence or grant attackers visibility into the investigation.