Forensic instances

Another option you can implement within your forensic account is forensic instances. These are instances that are specifically built to help you with your investigations and are loaded with forensic analysis tools and features. For example, if you had a compromised EBS volume, you could take a snapshot, copy the snapshot to your forensic account, build a new EBS volume from it, and attach it to your forensic instance, ready for investigation.

You can create a forensic instance in a few simple steps:

1. Select an AMI to be used for your forensic instance.
2. Launch an EC2 instance from this AMI. Be sure to use an EC2 instance that has a sufficient amount of processing power so that it can be used within your investigations.
3. Install all the latest security patches.
4. Remove all unnecessary software and applications from your operating system and implement audit and monitoring controls.
5. Harden your operating system as per best practices.
6. Install any software that you will be...