In cloud forensics, the examination and analysis phase is one of the essential processes in improving the performance of the forensic investigation. With the abundance of cloud information, determining the evidence significant to the crime event is a challenging task. Hence, cloud forensics research needs to focus on enhancing the examination and analysis phase to retain only the relevant evidence from the acquired artifacts to proceed with the effective forensic investigation in the cloud.