Forensics examination of volatile system data using virtual introspection

摘要: While static examination of computer systems is an important part many digital forensics investigations, there are often system properties present only in volatile memory that cannot be effectively recovered using analysis techniques, such as offline hard disk acquisition and analysis. An alternative approach, involving the live target to uncover this data, presents significant risks challenges forensic investigators observation techniques generally intrusive can affect being observed. This paper provides a discussion through virtual introspection suite tools developed for Xen (VIX tools). The VIX used unobtrusive data machines, addresses key research area identified virtualization agenda [22].