Question

A security analyst is performing forensic acquisition on a compromised EC2 instance that is still running and suspected of active data exfiltration. Company policy requires that both volatile and non-volatile evidence be preserved while minimizing the risk of tipping off the attacker or corrupting evidence. Which sequence of actions BEST preserves forensic integrity?

Accepted Answer

Isolate the instance with a forensic security group that denies all traffic, capture a memory dump using an SSM Automation runbook, then create EBS snapshots of the attached volumes before any shutdown.

Answer

Immediately stop the instance to halt exfiltration, then create EBS snapshots and copy them to the forensics account for offline analysis.

Answer

Detach the EBS volumes from the running instance first, attach them to a forensic workstation, then capture memory from the now-idle instance.

Answer

Terminate the instance to guarantee the attacker loses access, relying on prior AWS Backup recovery points for the volume evidence.