EC2, EBS, and Snapshots — Capturing Cloud Evidence

When you're investigating a compromised cloud environment, the virtual machine is often where the real action happened.

In AWS, virtual machines are EC2 instances, and their storage is handled by EBS volumes.

Understanding how these work — and what evidence they leave in CloudTrail — is essential for any cloud IR investigation.

-----------------------------------------------------------------------------------------------------

EC2 Instance Types — Why They Matter for IR

• T-series (t3, t4g) — general purpose, burstable. Most common. The free-tier instance type.

• M-series — balanced compute/memory for standard workloads.

• C-series — compute-heavy, more CPUs than RAM.

• P-series and G-series — GPU-equipped instances. These are the ones crypto miners love.

• I/D/H-series — storage-optimised, fast or dense storage.

💡 IR Tip: When looking for crypto mining abuse, search CloudTrail for RunInstances events where instanceType contains P or G prefix (p3, p4, g4dn, g5). Attackers use the largest available variant for maximum hash rate.

Regions Matter — Don't Miss Evidence in Other Regions

IAM is global, but EC2 instances and EBS volumes are regional.

A common investigation mistake: querying the wrong region and concluding no evidence exists when it's actually sitting in us-west-2 while you're looking in us-east-1.

CloudTrail logs always contain the awsRegion field for the event. When you find a suspicious RunInstances event, note the region — that's where the instance was created and where you need to look. Attackers frequently choose non-default regions specifically because teams overlook them.

-----------------------------------------------------------------------------------------------------

What an EC2 Instance Creation Looks Like in CloudTrail

RunInstances event (modified values): userIdentity.arn = arn:aws:iam::417823659031:user/devops-deploy, eventSource = ec2.amazonaws.com, awsRegion = eu-west-2, sourceIPAddress = 91.200.14.77, requestParameters.instanceType = g4dn.12xlarge, requestParameters.keyName = temp-access-key

What stands out:

• g4dn.12xlarge is a GPU instance (48 vCPUs, 192GB RAM) — nobody launches this for a web app.

• Unusual region (eu-west-2 vs org's normal us-east-1).

• Source IP 91.200.14.77 should be checked for VPN/TOR.

• Key name 'temp-access-key' is suspicious naming.

EBS — Elastic Block Store: AWS Storage Volumes

Every EC2 instance has at least one EBS volume — this is the virtual hard drive (like VMDK in VMware, VHD in Hyper-V). EBS volume types: gp3/gp2 (general purpose SSD, gp3 is now default), io2/io1 (provisioned IOPS for databases).

⚡ Update (2024): AWS changed the default EBS volume type from gp2 to gp3 in 2023. gp3 is 20% cheaper and provides 3,000 IOPS baseline without extra cost. This doesn't change anything forensically — both types behave identically from an evidence standpoint.

-----------------------------------------------------------------------------------------------------

Snapshots — Your Most Valuable Evidence Preservation Tool

EBS snapshots are incremental point-in-time images stored in S3 (managed by AWS).

• First snapshot = everything.

• Subsequent snapshots = only changed blocks (like Windows Shadow Copies).

You can take a snapshot of a running instance without interrupting it.

Create a snapshot via CLI:

aws ec2 create-snapshot --volume-id vol-0ab1234567890cdef --description 'DFIR preservation - Case #2026-047' --region eu-west-2

-----------------------------------------------------------------------------------------------------

Coldsnap — Downloading a Snapshot Without Restoring It

AWS provides Coldsnap, which uses the DirectBlockAccess API to download a snapshot directly as a disk image:

 coldsnap --region eu-west-2 download snap-0abc123456def7890 evidence.dd

Critical caveat:

if this is a differential snapshot (prior snapshots exist), the downloaded image only contains changed blocks and cannot be directly analysed as a full disk image. For full analysis, restore the snapshot to a volume first, then image it.

Full two-step restore process:

(1) aws ec2 create-volume --availability-zone eu-west-2a --snapshot-id snap-0abc123456def7890

(2) aws ec2 attach-volume --volume-id vol-0newvolumeid --instance-id i-0yourDFIRinstance --device /dev/sdf

💡 IR Tip: The two-step restore-and-mount approach is the most reliable for complete forensic analysis. The Coldsnap approach is faster but only safe when you know the snapshot is a full (first) snapshot, not incremental.

-----------------------------------------------------------------------------------------------------

EFS — The Shared Network Storage (Don't Overlook This)

EFS (Elastic File Store) is a network-attached NFS share — multiple EC2 instances can read and write simultaneously. Used for shared config, log aggregation, and distributed app data.

From an IR standpoint: data exfiltration via EFS shows up in VPC flow logs, not OS logs of individual instances. EFS gets a private IP in the VPC — you need flow logs to see what was accessed.

Snapshot Pricing

• First 1GB free per snapshot

• Beyond that: $0.05/GB/month

• Fast Snapshot Restore: $0.75/hour per enabled availability zone

• Coldsnap DirectBlockAccess reads: $0.003 per 1,000 blocks read

-----------------------------------------------------------------------------------------------------

What's Next

Next Article moves to the network layer — VPCs, subnets, internet gateways, load balancers, VPC flow logs, and Route 53 DNS logging.

-----------------------------------------------Dean--------------------------------------------