A fintech startup detects cryptomining on a payment EC2 instance, must preserve memory, disk, and VPC flow context for legal review, and keep evidence isolated from production tampering. Which forensic preservation workflow should the responder execute to capture isolated system and application logs?

The correct workflow preserves evidence while maintaining admissibility: isolation via security group change prevents tampering and lateral movement, live memory capture retains volatile cryptominer processes and injected code that disappear on shutdown, EBS snapshots preserve disk state for timeline analysis, and copying CloudTrail with VPC flow logs to an Object-Locked forensic bucket retains network context for legal review with chain of custody. The workflow that quarantines and snapshots disks with CloudTrail and VPC logs but omits memory fails on volatility principles because fileless mining and encryption keys reside only in RAM and disk imaging alone cannot reconstruct them. The workflow that isolates and captures memory and disk while archiving CloudTrail and host logs instead of VPC flows fails on network context because system logs show local execution but cannot prove command-and-control destinations or data volumes. The workflow that collects full memory, disk and cloud logs without removing the host from production fails on isolation because continued attacker access permits log deletion and evidence alteration, undermining legal defensibility despite complete artifacts. Exam caveat is to match each log to its forensic question rather than treating logs as interchangeable. Practical check is to verify image hashes, snapshot IDs, log time ranges and bucket immutability with access logging before analysis begins.