Hypervisor Event Logs as a Source of Consistent Virtual Machine Evidence for Forensic Cloud Investigations

Thorpe, Sean; Ray, Indrajit; Grandison, Tyrone; Barbir, Abbie

doi:10.1007/978-3-642-39256-6_7

Cited by 8 publications

(2 citation statements)

References 15 publications

(31 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The virtualization technology can be largely divided into the application virtualization [25][26][27][28][29][30][31][32][33][34][35][36][37][38][39], server virtualization [26][27][28], network virtualization [29][30][31], desktop virtualization [32][33][34][35] and storage virtualization. We attempt to describe technical characteristics, trends and current foundation technologies for each category.…”

Section: Virtualizationmentioning

confidence: 99%

Design and test bed experiments of server operation system using virtualization technology

Huh

Seo

2016

Hum. Cent. Comput. Inf. Sci.

View full text Add to dashboard Cite

According to current researches, much of the electric power is being consumed by the server cooling system at the Data Center. Moreover, the power consumption rate increases when the number of the equipments and servers expands. Thus, the proposed server operation system has been designed to decrease power consumption rate and CO2 emission volume by minimizing the number of these equipments and simplifying the physical composition of the system. Virtualization technology was adopted in both designing and implementation phases to improve resource efficiency of the system. As a result, significant amount has been saved while constructing the server operation system in this paper. System’s performance has been evaluated using a virtual machine prior to its practical use through test bed experiments and the results confirms our expectation that the virtual hardwares will work as efficiently as actual ones.

show abstract

Section: Virtualizationmentioning

confidence: 99%

Design and test bed experiments of server operation system using virtualization technology

Huh

Seo

2016

Hum. Cent. Comput. Inf. Sci.

View full text Add to dashboard Cite

show abstract

“…Digital forensics uses the previously mentioned scientific and proven methods to provide interpretive analysis of potential ESI evidence to reconstruct events [9]. The digital investigator is responsible for assessing the ESI to reconstruct timelines that describe as completely as possible what happened and when it happened [10]. However, one cannot just simply apply digital forensics (or traditional forensics) methodology directly to cloud forensics, because 1) it is not possible to perform a one-to-one mapping, and 2) cloud forensics must also involve evidence from all the cloud actors with the process flow model.…”

Section: Introductionmentioning

confidence: 99%

Cloud computing log forensics-the new frontier

Thorpe

Grandison

Blake

2014

Ieee Southeastcon 2014

Self Cite

View full text Add to dashboard Cite

Cloud computing is becoming commonplace in industry. With this rise in adoption and use, there is a growing requirement to enable forensic investigators to collect, analyze and produce evidence that can be used in court cases. Unfortunately, traditional and digital forensics techniques cannot be directly applied to the cloud computing paradigm. In this paper, we explore the need created by cloud computing log forensics, discuss the issues involved, and highlight the unsolved research challenges in the space.

show abstract

A Taxonomy of Hypervisor Forensic Tools

Mishra

Govil

Pilli

2020

Advances in Digital Forensics XVI

View full text Add to dashboard Cite

Cloud computing models are deployed on a compute server whose hardware resources are virtualized to enable multiple virtual machines to run on a single physical system. Several types of virtualization such as bare metal and hosted virtualization are available along with virtualization modes such as full, paravirtualized, hardware-assisted and paravirtualized-hardware-assisted virtualization. Virtual machines are inaccessible from each other when the physical server hardware is abstracted in the full virtualization mode. Physical information such as hard disk drives and server memory are made available in a virtualized environment as a virtual hard disk, vCPU and guest operating system state.Hypervisor operations generate copious amounts of data that are of value in forensic investigations of virtualized cloud environments. This chapter presents a taxonomy of hypervisor forensic tools, which provides a searchable catalog for forensic practitioners to identify specific tools that fulfill their technical requirements. A case study involving a KVM hypervisor demonstrates the evidence that can be found in a virtual machine at the virtual machine manager and host system layers.

show abstract

Hypervisor Event Logs as a Source of Consistent Virtual Machine Evidence for Forensic Cloud Investigations

Cited by 8 publications

References 15 publications

Design and test bed experiments of server operation system using virtualization technology

Design and test bed experiments of server operation system using virtualization technology

Cloud computing log forensics-the new frontier

A Taxonomy of Hypervisor Forensic Tools

Contact Info

Product

Resources

About