US Patent 10148675 Block-level forensics for distributed computing systems

A computing resource service provider may provide customers with a block-level forensics service. Volume images of computing resource associated with customer may be generated and provided to the block-level forensics service. The block-level forensics service or component thereof may generate a volume based at least in part on the volume image and may perform forensics analysis of the volume. A result of the forensic analysis may be provided to the customer.