Search: how to do forensics on a compromised EC2 instance

Public search query: how to do forensics on a compromised EC2 instance

Problem outcome: unknown