Hacker News Reader

You should still access that data in an offline manner, though—ideally:

1. Shut down the instance

2. Connect the storage as secondary storage on another (disconnected from the network) instance

3. Do forensics using your cloud provider's out-of-band management interface

4. Throw away that instance as soon as you're done

You can't physically access the disk, but you often can download a snapshot or disk image, which is created at the hypervisor level.

Every cloud provider out there would help you get an image of the disk if you told them it was due to a security breach.