I think the OP's point is that Amazon EC2 can run 100s of instances for one customer which could be on up to 100 different physical servers and when not using E

I think the OP's point is that Amazon EC2 can run 100s of instances for one customer which could be on up to 100 different physical servers and when not using EBS roots, any one of those servers might still contain the evidence the FBI wants. Mentioning the specifics of Amazon further, what about if your account for the highly illegal operation was using/paying for EBS/S3/SimpleDB/RDS/SQS/SNS/SES (or all at the same time). Any could contain forensic evidence of a crime as they hold data in some sense. EBS especially is likely to run on some kind of SAN; would they have to crack open the racks and take out individual drives? would they have to take whole arrays of discs because of RAID-esque striping? It's like a LEO denial of service (both on amazon and the forensic analysis). Pragmatically, they might trust amazon enough to consolidate/quarantine the data into the smallest surface area first.