I've been a web developer for over 5 years and never once worked somewhere where I'd have any imaginable way of physically accessing the disk of a server. Everything's been cloud-based. I don't know the exact ratios, but I'd expect my experience not to be unusual.

You should still access that data in an offline manner, though—ideally:

1. Shut down the instance

2. Connect the storage as secondary storage on another (disconnected from the network) instance

3. Do forensics using your cloud provider's out-of-band management interface

4. Throw away that instance as soon as you're done

You can't physically access the disk, but you often can download a snapshot or disk image, which is created at the hypervisor level.

Every cloud provider out there would help you get an image of the disk if you told them it was due to a security breach.