RIT Scholar Works (Rochester Institute of Technology) · 2012 · 15 citations · 2 references
Open access
ComputingComputer EngineeringComputer SystemsDigital ForensicsVictimologyVirtualizationComputer ForensicsEvidence AcquisitionForensic EvidenceForensic ReportingVirtual Machine ForensicsVirtual Machine MonitorsForensic InvestigationForensic Investigation CoverageForensic Investigation ReportsForensicsVirtual Machine AcquisitionVirtual Machine Artifact AnalysisVirtual Machine Evidence PreservationVirtual Machines
Abstract — With the advancement in virtualization technology, virtual machines (VMs) are becoming a common and integral part of datacenters. As the popularity and the use of VMs increases, incidents involving them are also on the rise. There is substantial research on using VMs and virtual appliances to aid forensic investigation, but research on the appropriate forensics procedures for collecting and analyzing evidence within a VM following is lacking. This paper presents a forensically sound way to acquire and analyze VM hard disks. A forensics tool for analyzing VM snapshots and vmdk files is developed and has been proven to be forensically sound.
2