I currently have an instance on AWS which was compromised and resulted in me losing control. I have shutdown the instance since then, but require a forensic image of the volume so that I can analyze it further.
I have mounted the volume onto another instance to run
dd command. when I check the size of the volume it shows 16MB used.
What am I doing wrong?