Copying data

Again, following on from the previous example of a compromised EC2 instance, let's also assume that the instance was backed by EBS storage. You may just want to isolate and analyze the storage of this instance from within your forensic account, and this can be achieved through the use of EBS snapshots. These snapshots are essential incremental backups of your EBS volumes.  

Creating a snapshot of your EBS volumes is a simple process:

1. From within the AWS Management Console, select the EC2 service from the Compute category.
2. Select Volumes from under the ELASTIC BLOCK STORE menu heading on the left:

3. Select your volume from the list of volumes displayed:

4. Select the Actions menu and select Create Snapshot:

5. Add a description and any tags that are required:

6. Select Create Snapshot. At this point, you will get a message stating that the requested snapshot has succeeded:

7. Click on Close.
8. You can now ensure that your snapshot has been...