Host and image forensics

Drydock

Inside the machines, without sailing them.

The pursuit tool follows who did what at the AWS control plane; this one looks inside the machines they touched. It captures memory before isolation, copies every disk into an isolated forensic account you own, and analyzes the copies offline without ever booting the suspect, the way a dry dock hauls a ship out of the water so its hull can be inspected without sailing it.

What it touches in your organization Start an engagement at vantalect.com
A large steel ship hauled out in a drained dry dock at night, its whole hull lit by cold floodlights beneath gantry cranes.A large steel ship in a drained dry dock on a bright morning, its hull exposed beneath gantry cranes.

What it does

How it works.

  1. Captures memory first.

    While the instance still runs, a Systems Manager document you approve captures its memory (AVML on Linux, WinPmem on Windows) straight into an Object Lock evidence bucket in your forensic account, with the tool, its version, its hash, and the start and end times recorded.

  2. Isolates without stopping.

    A containment document you approve swaps the instance's security groups for a deny-all group, turns on termination protection, and detaches it from its Auto Scaling and target groups, so nothing replaces or reaps it. It ends with a read that proves the isolation held.

  3. Copies every disk out.

    Every attached volume is snapshotted together, re-encrypted, shared, and copied again under your forensic account's own key. The forensic account has no internet egress.

  4. Analyzes offline, never booting the suspect.

    From volumes mounted read-only on a clean analysis instance, or from snapshot blocks read directly through the EBS direct APIs: malware and YARA scans, packages and a CycloneDX SBOM, persistence, a file-system and log timeline, and a diff against the instance's own source image.

  5. Reads the logs on disk.

    Windows event logs (Security, System, PowerShell, Sysmon, Defender) and SQL Server's error log, default trace, audit files, and Extended Events, plus the RDS log APIs where there is no disk to read.

  6. Covers containers and Kubernetes.

    Container images pulled by digest, file-system captures of running containers, and Kubernetes nodes handled like any instance: memory, isolation, snapshots. Cordoning is proposed; draining is not, because it kills the pods that are the evidence.

  7. Keeps the chain of custody.

    Every artifact is hashed at acquisition, every snapshot gets a block manifest, and every acquisition, copy, access, and analysis step is a custody record: who, when, under which approval, with which tool version. Indicators found on disk or in memory go back to the pursuit tool.

By design

What it never does.

  • Boots, stops, or reboots the suspect machine.
  • Writes to an evidence snapshot or a sealed evidence object.
  • Runs a step in an affected account that you did not approve.
  • Moves a disk or memory image out of your forensic account.
  • Gives the forensic account internet egress, or embeds GPL or AGPL code.

Footprint

What it touches in your organization.

Your forensic account
An isolated account inside your own organization: no internet egress, its own KMS keys, evidence in S3 Object Lock, and a clean analysis image built from a recipe you can read. Vantalect operates there through a role you grant in that account only.
Affected accounts
No credential of its own. Operators may start only the forensic documents you registered, at a pinned version; your approver approves, and Systems Manager runs them under your role, which can capture, snapshot, copy, and share and cannot edit its own policies.
Where the data lives
Every disk and memory image stays in your forensic account. The custody record and hashes are kept by Vantalect, and only reviewed findings reach Pavilion. Acumen Defensive holds none of it.
Compare every tool’s footprint

In Vantalect’s engagements

Where it fits.

  • AWS Incident Response and Breach Forensics: Drydock is the primary tool. The pursuit tool follows the intruder across the control plane, the forensics tool examines the machines it touched, and the survey supplies the estate snapshot and rescans what the intruder reached.

Put the tools to work

Engagements run through Vantalect.

Acumen Defensive builds the tools and runs no engagements of its own. Vantalect delivers every engagement that uses them, with the scope and price of each published at vantalect.com.

Start an engagement at vantalect.com

Vantalect, LLC is a separate company that licenses and operates these tools.