A county uses Lambda-backed response to snapshot EBS volumes before wiping a malware-hit jump box. What IR automation priority is that?

Preserving forensic artifacts with automated snapshots before destructive AWS remediation ensures county investigators retain disk evidence from a malware-hit jump box before Lambda-backed response wipes or replaces the instance. Snapshot-then-wipe sequencing supports root-cause analysis, timeline reconstruction, and potential legal or insurance needs while still allowing timely remediation. Automating the snapshot step reduces the chance busy responders skip evidence capture under pressure. Containing lateral movement with automated snapshots enforcing security group isolation confuses preservation with containment—snapshots capture disk state but cannot enforce security group isolation, and the box can be fully quarantined yet still get wiped before evidence is captured, so isolation alone does not satisfy the preserve-before-destroy requirement. Eradicating malware persistence with automated snapshots executing Run Command cleanup misattributes the tool—snapshots capture disk evidence but do not execute Run Command cleanup, and running remediation without a prior snapshot destroys attacker tools and timeline clues, so cleanup alone does not satisfy the preserve-before-destroy requirement. Restoring service operations with automated snapshots initiating CloudFormation rebuild tasks confuses preservation with recovery—snapshots preserve evidence but do not initiate CloudFormation rebuilds, and CloudFormation can recreate a clean jump box quickly but it cannot recreate the attacker tools, credentials, and lateral-movement clues that only a pre-wipe snapshot preserves. Exam caveat: Prefer preserve-then-destroy ordering for automated AWS IR. Isolated, cleaned, or quickly rebuilt hosts are not an excuse to skip snapshots, and snapshots enforcing security group isolation, snapshots executing Run Command cleanup, or snapshots initiating CloudFormation rebuild tasks are no substitute for a pre-wipe snapshot when the exam is testing forensic readiness. Operational check for county IR automation: on a staging jump box, trigger the Lambda-backed response, confirm EBS snapshots complete and are tagged to the incident ticket before wipe actions run, verify CloudTrail remains enabled, and sample restoring snapshot metadata into the case file for municipal evidence handling.