A gaming startup suspects an EC2 instance was compromised via a web app, and legal requires bit-for-bit disk copies plus volatile memory and instance metadata preserved in a separate forensic account with chain of custody. The instance must stay isolated but running. Which forensic log and artifact capture plan preserves admissible evidence?

Isolation via security groups preserves running state for memory capture while preventing lateral movement, EBS snapshots with Snapshot Lock provide tamper-evident disk images, SSM-based memory acquisition preserves volatile evidence, and exporting CloudTrail plus OS and application logs to an Object Lock vault in a forensic account maintains chain of custody. Terminating and replacing the instance destroys volatile and disk evidence and CloudWatch metrics alone are not forensic artifacts. Copying to Standard S3 without Object Lock and sharing volumes lacks immutability and custody controls, risking alteration. Rebooting clears memory-resident malware and UDP syslog is lossy and unprotected, violating preservation requirements. Exam caveat: always preserve to a dedicated forensic account with separate KMS keys and Object Lock retention. Practical check: tag snapshots with case ID, record hashes, and verify snapshot lock and S3 retention before analysis.