Use when investigating in the cloud where there's no disk to image — reconstructing events from audit logs, snapshots, and provider APIs instead of traditional acquisition.
