I currently have an instance on AWS which was compromised and resulted in me losing control. I have shutdown the instance since then, but require a forensic image of the volume so that I can analyze it further.

I have mounted the volume onto another instance to run dd command. when I check the size of the volume it shows 16MB used. What am I doing wrong?

closed as off-topic by multithr3at3d, Xander, forest, A. Hersean, schroeder May 6 at 9:08

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • How did you check the size of the volume? – forest Apr 19 at 1:51
  • Df -h after mount. – shezi27 Apr 19 at 2:50
  • Are you sure you mounted the correct partition? – forest Apr 19 at 3:00
  • Yes, it was /dev/xvdf1. – shezi27 Apr 19 at 3:02
  • What does fdisk say about the entire disk? – forest Apr 19 at 3:04

Browse other questions tagged or ask your own question.