Take Amazon EBS volume snapshots of the compromised EC2 instances to capture the current state of the disk.

Use memory dump tools to capture the memory of the compromised EC2 instances for further analysis.

Store the captured forensics data in an isolated Amazon S3 bucket with appropriate access controls to ensure the integrity and confidentiality of the data.

Enable S3 Object Lock on the S3 bucket containing the forensics data to prevent unauthorized deletion or modification of the objects.