EBS snapshot
A point-in-time, block-level copy of an EBS volume stored in S3. Snapshots are incremental, encrypted if the source volume is encrypted, and shareable across AWS accounts. The standard forensic acquisition mechanism for an EC2 instance disk.