A gaming studio suspects EC2 instances are mining cryptocurrency and must preserve volatile memory, disk snapshots, and OS and application logs as court-admissible evidence while keeping production running. Chain of custody and timestamps are critical. Which forensic artifact collection approach should the responder execute to ensure complete preservation?
Select an answer to reveal the explanation.
Short Explanation
You can keep production running while preserving the evidence needed for a defensible investigation. Live capture retains volatile memory, while EBS snapshots and immutable log storage protect disk state and records with timestamps. Isolating the hosts without shutting them down helps you preserve the scene and maintain chain of custody.
Full Explanation
The approach that isolates hosts with security groups, captures memory through SSM, snapshots EBS, and ships logs to S3 Object Lock preserves all required evidence while keeping production running. Security-group isolation contains lateral movement without shutting down the instances; live SSM capture retains processes, keys, and miner payloads that would be lost on power-off; EBS snapshots freeze disk state for repeatable analysis; and Object Lock provides immutable log retention, supporting timestamps and a verifiable chain of custody. Quarantining hosts, snapshotting volumes, and forwarding logs to an immutable vault omits volatile memory, losing the in-RAM evidence the scenario requires. Capturing memory and disk but streaming logs to versioned S3 buckets is incomplete for admissibility: versioning alone allows deletion or modification, so chain of custody cannot be established through immutability. Halting instances before acquiring memory and snapshots destroys volatile data, alters system state, and stops production; that approach is unsuitable when the studio must keep running, even though downtime may be acceptable in other circumstances. Exam caveat: when memory, disk, logs, continuity, and legal preservation are all required, omission of any one makes an approach incomplete. Practical check: confirm SSM reachability, successful snapshots, the Object Lock policy, NTP synchronization, and recorded hashes and custodian names before closing collection.