Disk forensics acquisition workflow

Disk forensics acquisition workflow

The Forensic triage Step Function initiates disk acquisition flow. . The Perform Instance Snapshot Lambda function performs an instance snapshot. . The Perform Instance Snapshot Lambda function assumes a role in the application account and initiates an instance snapshot API call. . Check for Instance Snapshot Lambda function assumes a role in the application account and checks for snapshot completion. . If the response is Pending or In Progress it waits for 120 seconds. . The disk acquisition flow copies the compromised instance snapshot using AWS KMS keys shared with the forensic account. . After the copy snapshot operation of the compromised instance, the disk acquisition flow shares the copied EBS snapshot with the forensic account. . To keep the copy of snapshot in the forensic account, copy the shared copy of compromised instance snapshot using Forensic KMS keys. This step allows protection of the shared snapshot with a local copy to perform forensics in case of the AWS account being compromised, or the shared snapshot being deleted by the security team. . Post copy flow the step functions initiates the investigation flow with forensic type as DISK.