EBS Snapshot
Definition
A point-in-time, block-level copy of an EBS volume stored in S3. Snapshots are incremental, encrypted if the source volume is encrypted, and shareable across AWS accounts. The standard forensic acquisition mechanism for an EC2 instance disk.
- Type
- Point-in-time, block-level volume copy
- Storage location
- Amazon S3
- Backup style
- Incremental
- Encryption
- Inherits encryption of the source volume
- Sharing
- Can be shared across AWS accounts
Common questions
Why is an EBS snapshot preferred over a live disk image for cloud acquisition?+
Taking a snapshot avoids the need to halt the running instance or install acquisition tooling on it, and it captures a consistent block-level state that can be mounted read-only or exported for analysis without altering the original volume.
Does an incremental snapshot chain complicate chain of custody?+
It can, because restoring a later snapshot may depend on earlier increments still existing in the account. Examiners typically export a full, self-contained image from the snapshot at acquisition time rather than relying on the incremental chain remaining intact.
Related terms
- CERT-in Direction April 2022
- Direction issued under Section 70B(6) of the IT Act 2000 requiring 6-hour incident reporting, 180-day log retention in India, KYC retention by...
- CloudTrail
- AWS service that records every control-plane API call across an AWS account, with the principal, source IP, action, target resource and timestamp....
- MLAT
- Mutual Legal Assistance Treaty. The formal mechanism for cross-border evidence requests. India has bilateral MLATs with over 40 countries including the US,...
- NIST IR 8006
- The August 2020 NIST Interagency Report titled NIST Cloud Computing Forensic Science Challenges. Catalogues 65 challenges across nine categories: architecture, data collection,...
- Significant Social Media Intermediary
- Under IT Rules 2021, an intermediary providing services with more than 50 lakh (5 million) registered users in India. Triggers additional obligations:...