Is there a point-and-click way to generate a forensic image of an EC2 system, rather than having to ssh on and dd?
-
I believe Amazon supports an export to S3 storage, which of course you pay for. If the image is particularly large, it may be more practical to run the forensic analysis directly on Amazon machines instead of ssh'ing the image down, which could be very expensive. If you are LE, Amazon has been known to perform an on premises image to physical disk to FedEx.– user10216038Jul 13, 2021 at 15:54
-
This seems like a question for AWS.– schroeder ♦Jul 13, 2021 at 20:47
-
If you only want the volume (not the contents of RAM or instance storage (which most server types don't have)) you can snapshot the volume– user253751Aug 11, 2022 at 14:31
Add a comment
|
1 Answer
Three free options:
- As you suggest deploy a box to acquire, snapshot and make a new volume, then run the dd command combined with “aws cp”
- Point and click with https://www.cadosecurity.com/cado-cloud-collector
- SDK with https://github.com/google/cloud-forensics-utils
