Live Digital Forensics in a Virtual Machine

摘要：

Traditional computer forensics is performed towards physical machines, using a set of forensic tools to acquire disk images and memory dumps. But it is much more different to deal with virtual machines. Live forensics is used to acquire volatile data and improve efficiency, but how to perform live forensics on a subject system with virtual machines hosted in? This paper discusses how virtual machines can be used both as forensic evidence and tools, proposes methods of how to collect data associated with virtual machines from the host system, and discusses methods and tools of how to boot the acquired subject system OS into a virtual machine.

关键词： digital forensics live forensics virtual machine memory acquisition

作者: Lei Zhang Dong Zhang Lianhai Wang

作者单位: Laboratory of Computer Forensics Shandong Computer Science Cente: Jinan, China Qingdao Technological University Qingdao, China Laboratory of Computer Forensics Shandong Computer Science Center Jinan, China

会议类型: 国际会议

会议名称: The 2010 International Conference on Computer Application and System Modeling(2010计算机应用与系统建模国际会议 ICCASM 2010)

会议地点: 太原

会议语种:英文

页码: 328-332

在线出版日期: 2010-10-22（万方平台首次上网日期，不代表论文的发表时间）