Virtualization and Digital Forensics: A Research and Education Agenda

Abstract

The application of virtualization software and techniques in information technology research and education has provided a foundational environment to advance the state-of-the-art in research and education in many related areas. Commercial and open source virtualization products are being used by researchers and educators to create a wide variety of virtual environments. These virtual environments facilitate systems design and development and product development as well as the testing and modeling of production and preproduction systems. As the capabilities, functionality, and stability of these products have evolved, the use of virtualization has expanded, necessitating the identification of new research areas to investigate the impacts of virtualization on digital forensics. In February 2007, a group of digital forensics researchers, educators, and practitioners gathered at the National Center for Forensic Science at the University of Central Florida for the 2007 Workshop on Virtualization in Digital Forensics to discuss these issues and develop a research and education agenda for virtualization and digital forensics. This article outlines some of the ideas generated and new research categories and areas identified at this meeting.

Digital Forensics: Defining a Research Agenda

“…Recent advances in the field 1 Such as whether the injection of packets occurred between the sender and the monitoring point-in which case someone other than the sender was doing the injecting; how the analysts determined that the packets were being "stealthily injected" rather than merely "injected" and what that means; and whether the sender's software inserted the packets without her knowledge, as might happen if the sender's system was compromised, for example by a Trojan horse.…”

“…A lay jury may be impressed by a statement like "the use of the stealthy injection of packets clearly indicates the sender was trying to evade the detection mechanisms" but in fact, technologically, the statement embodies a number of assumptions that must be validated before such a claim can be made 1 . The technical sophistication of the audience is critical here.…”

Digital Forensic Research: The Good, the Bad and the Unaddressed

“…Dorn and coworkers [25] recently examined the digital forensic impact of virtual machines on their hosts. This work falls in the important area of "analysis of virtual environments" [51], which includes forensic data acquisition, virtual platform forensics and virtual introspection.…”

“…Most research efforts have focused on leveraging virtualization in digital forensic analytic environments [8,19,49] or in educational environments [51] rather than conducting digital forensics of virtual environments. Dorn and coworkers [25] recently examined the digital forensic impact of virtual machines on their hosts.…”

Using Virtualization to Create and Deploy Computer Security Lab Exercises

“…The objective of Lab Exercise 2 is to increase students understanding of the process associated with incident response and addresses a key research area identified in the virtualization in digital forensics research agenda [14]. The target audiences for the examples are extremely varied.…”