Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

AWS linux forensic

0

we have create three AWS linux AMI volumes (Xvda1, xvdf1, xdvf2)from 3 forensic snapshot. now i need to mount to forensic instance(already have xvda1 and xvdf1), should I mount the three volumes from compromised instance to xvda2, xvdf2, xvdf3 in sequence in the forensic EC2 instance?

Topics
Compute
Tags
Amazon EC2
Language
English
asked 4 years ago281 views
1 Answer
0

From this distance it's not possible to say. It depends entirely on how they were mounted and how the original operating system used those volumes. If you intend to use the volumes in the same way as the original instance then they must be mounted in the same way on your forensic instance.

AWS
EXPERT
answered 4 years ago
  • AWS-User-6667474
    4 years ago

    compromised instance: xvda1 ---/(mount point) xvdf1----/a (mount point) xvdf2-----/b (mount point)

    forensic instance xvda1----/(mount point) xvdf1-----/c (mount point)

    I can't mount xvda1 from compromised instance to forensic instance xvda1, because it will overwrite xvda1 partition, i should mount xvda1 from compromised instance to xvda2 of forensic instance or i should mount into xvdf2? as xvda1 is root partition in compromised instance.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content