How do you ensure that evidence is preserved when responding to a breach in an ephemeral cloud environment?
