Cado Cloud Collector

Cado Cloud Collector is a solution to make forensic imaging of AWS EC2 instances a whole lot easier. Setup takes only 5 mins, and then you can use it to forensically image any instance in your AWS region in just a few clicks.

We are releasing it free to the security and digital forensics community.


We have released Cado Cloud Collector under our Freeware License.

You can deploy Cloud Collector by deploying our Amazon Machine Image (AMI) to AWS EC2.

The AMI IDs are:

RegionAMI ID
N. Virginia (us-east-1)ami-0f5c7532967db449e
Ohio (us-east-2)ami-07f7fb877f9baa1b5
N. California (us-west-1)ami-0ffc5625b26a8f1b0
Oregon (us-west-2)ami-099b9fbcaaae224a4
London (eu-west-2)ami-00b7c84d06046ffda

If your region is not listed above, you can copy the AMI from one of the pre-existing regions to the region you are using.

You will need to whitelist your IP Address on port 443 in the firewall for the instance. Never allow public access to your Cado Cloud Collector instance.

For FAQ’s and details on how to use Cado Cloud Collector please see our Documentation.

Please note that AWS does not allow you to create snapshots of some products from the AWS marketplace. You can use Cado Host to perform a live collection instead.

Version: 1.01


We would love to hear any feedback you might have. Whether it be bug reports, feature suggestions or other comments.

Please contact us to let us know.

You can also use our dedicated issue tracker for both feature requests and issues.

Cado Cloud Collector was made possible thanks to a number of supporting applications, – you can view them on the acknowledgements page.

It’s not all we’re building

Find this cool? We are also busy building a cloud-native forensics and response platform for responding to security incidents.

Be the first to get updates or beta-test our platform by signing up here: