Incident Response in Amazon EC2:
First Responders Guide to Security Incidents in the Cloud
A SANS GCIA GCFE Gold Certification Paper (accepted April 2016) by Tom Arnold
http://digital-forensics.sans.org/community/papers/gcfe/incident-response-amazon-ec2-first-responders-guide-security-incidents-cloud_1624