In this scenario, when should the investigators ensure that a forensic instance is in the terminated state?

TetraSoft Pvt. Ltd. is an IT company that provides software and application services to numerous customers across the globe. In 2015, the organization migrated its applications and data from on-premises to the AWS cloud environment. The cloud security team of TetraSoft Pvt. Ltd. suspected that the EC2 instance that launched the core application of the organization is compromised. Given below are randomly arranged steps involved in the forensic acquisition of an EC2 instance.

In this scenario, when should the investigators ensure that a forensic instance is in the terminated state?
A . After creating evidence volume from the snapshot
B . Before taking a snapshot of the EC2 instance
C . Before attaching evidence volume to the forensic instance
D . After attaching evidence volume to the forensic instance

Answer: A