https://cramsession.net/index.php?action=history&feed=atom&title=Isolating_EC2_Instances_for_Forensic_Inspection 2026-05-27T08:01:01Z Revision history for this page on the wiki MediaWiki 1.41.1 https://cramsession.net/index.php?title=Isolating_EC2_Instances_for_Forensic_Inspection&diff=945&oldid=prev 2025-05-19T01:51:13Z

<p></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 01:51, 19 May 2025</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l1">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>[[Study Guides]] &gt; [[AWS Cybersecurity Notes]] &gt; Isolating EC2 Instances for Forensic Inspection</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>[[Study Guides]] &gt; [[AWS Cybersecurity Notes]] &gt; Isolating EC2 Instances for Forensic Inspection</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>The best eay to do this is through the creation of a forensic account.</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>The best eay to do this is through the creation of a forensic account.</div></td></tr> <!-- diff cache key my_wiki:diff:1.41:old-944:rev-945:php=table --> </table>

Mflavell https://cramsession.net/index.php?title=Isolating_EC2_Instances_for_Forensic_Inspection&diff=944&oldid=prev 2025-05-19T01:50:56Z

<p></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 01:50, 19 May 2025</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l1">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">[[Study Guides]] &gt; [[AWS Cybersecurity Notes]] &gt; Isolating EC2 Instances for Forensic Inspection</ins></div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>The best eay to do this is through the creation of a forensic account.</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>The best eay to do this is through the creation of a forensic account.</div></td></tr> <!-- diff cache key my_wiki:diff:1.41:old-943:rev-944:php=table --> </table>

Mflavell https://cramsession.net/index.php?title=Isolating_EC2_Instances_for_Forensic_Inspection&diff=943&oldid=prev 2025-05-19T01:48:55Z

<p>Created page with &quot; The best eay to do this is through the creation of a forensic account. * Keeping the EC2 instacne inside the production account can be dangeriouous. :* Any malcious software could spread to other production systems. = Isolate it = * Isolate the problem instance from everything else. :* Remove it from the production network. :* Prevent access to the instance. == How to isolate == * Creare a snapshot of the instance. :* Share the snapshot with the forensic accou...&quot;</p> <p><b>New page</b></p><div><br /> The best eay to do this is through the creation of a forensic account.<br /> <br /> * Keeping the EC2 instacne inside the production account can be dangeriouous.<br /> <br /> :* Any malcious software could spread to other production systems.<br /> <br /> = Isolate it =<br /> <br /> * Isolate the problem instance from everything else.<br /> <br /> :* Remove it from the production network.<br /> <br /> :* Prevent access to the instance.<br /> <br /> <br /> == How to isolate ==<br /> <br /> * Creare a snapshot of the instance.<br /> <br /> :* Share the snapshot with the forensic account.<br /> <br /> * Take a memory dump fo the insance if possible.<br /> <br /> * Change the security group of a instance to isolate it quickly.<br /> <br /> :* This approach also preserves as much evidence as possible.<br /> <br /> :* Any changes you make may appear on logs - this is bad for the investigation.</div>

Mflavell