Cado Cloud Collector is a free solution to make forensic copies of AWS EC2 instances for forensic analysis after a security incident.
The setup takes only 5 minutes, and then you can use it to forensically image any instance in your AWS region to S3.
Cloud Collector performs hashing, and a full dd image, of all volumes attached to an EC2 instance.