I suspect that what happened in the case of this Bitcoin exchange is that the data was stored on an EBS volume that was marked to "delete on termination" and the site operator had never taken any snapshots. This (delete volume on termination) is the default for the root file system of an EBS-backed instance, but it can be modified.
An AMI is a combination of:
- block device mappings (ephemeral and/or EBS)
- a kernel
- a ram disk
If your instance is EBS-backed (you have an EBS volume for your root file system), it is sufficient to create a snapshot of this EBS volume. If you need to launch a new instance based off your EBS snapshot, you would register a new AMI with the same kernel and RAM disk as your original AMI, but with an EBS volume created from your snapshot as the new root device.