Understand that the dramatic rise of cloud computing has transformed the landscape of the digital forensics. it supports high-speed access to data distributions but at the same time evolves new challenges in certain areas; For example, scalability, probity, and security. Conventional models for forensic applications In addition, the serial hashing (hashingSHA-256) and HMAC version of the AES-GCM are no longer secure with block cipher encryption. threat of high-concurrency, including Grammy nonce reuse attacks on their integrity, and poor chain of custody management system Gap Analysis and a Separate Enhanced Digital Forensic Security Framework We offer in this paper an efficient encryption model based on the XChaCha20-Poly1305 encryption that is resistant to most of the known attacks. Added algorithm implemented together with BLAKE3 parallel hashing and runs in an orchestration framework. A cloud native + mated, Apache Spark + Kubernetes system. The model plays the role of confidentiality provider Integrity and Provenance Binding via Additional Authenticated Data (AAD) AND produces an audit log consistent with NIST SP800–201 forensic at hash-chained atomic scope in tamper-evident format readiness requirements. Experimental evaluation shows 217% increase of ingestion speed. In comparison, when using our workflow throughput goes over 60%, integrity verification is carried out 4x faster with 100% efficacy of tampering. Low cost per and detection and scaling efficiency of 80% + with no more than 32 executors. a terabyte for its cost/benefit compared to AES-GCM. These findings demonstrate the validity of the proposed The solution is a modern and secure, scalable, and forensically sound approach to investigations in the cloud.