ch10

Chapter 10: Virtual Machine Forensics, Live Acquisitions, and Network Forensics

Overview

  • Application of computer forensics focusing on virtual environments, live systems, and network structures.

Objectives

  • Explain standard procedures for forensic analysis of virtual machines.

  • Describe the process of live acquisition.

  • Clarify network intrusions and unauthorized access.

  • Detail standard procedures in network forensics and the use of network-monitoring tools.

Virtual Machine Forensics

Definition and Importance

  • Virtual Machines (VMs): Ubiquitous in personal and business environments; require knowledge for analysis.

  • Hypervisor: Software that enables running VMs. Two types:

    • Type 1 Hypervisor: Operates directly on physical hardware (no host OS).

    • Type 2 Hypervisor: Runs on an existing OS.

Usage of Hypervisors

  • Type 2 Hypervisors: Common on suspect machines; typically installed for personal or business computing.

    • Examples include:

      • Parallels Desktop (for Mac users)

      • KVM (Linux)

      • Microsoft Hyper-V (Windows 10)

      • VMware Workstation/Player

  • Type 1 Hypervisors: Generally found on servers/workstations with high storage and RAM.

    • Examples include:

      • VMware vSphere

      • Microsoft Hyper-V 2016

      • XenProject XenServer

      • IBM PowerVM

      • Parallels Desktop for Mac

Conducting Virtual Machine Investigations

  1. Initial Steps:

    • Acquire forensic image of the host computer and network logs.

    • Link VM’s IP address to log files for web activity insights.

    • Identify the presence of VMs via:

      • User directories or Documents folder in Windows/Linux.

      • The Windows Registry for installation clues.

  2. Investigation Techniques:

    • Check for attached USB drives hosting live VMs.

    • Search for nested VMs on both host machines and USBs.

  3. Consistent Procedure:

    • Image the host machine.

    • Locate virtualization software and associated VMs.

    • Export all VM-related files from the host.

    • Record hash values for integrity checks.

    • Utilize forensic imaging software to analyze VMs.

Live Acquisitions

  • Necessary to capture snapshots and current states of VMs.

  • Key steps include:

    • Creating a bootable forensic medium.

    • Logging actions during the process.

    • Copying RAM and creating digital hashes for recovered files.

Network Forensics Overview

Significance

  • Involves collecting, analyzing raw network data, tracking event occurrences, and mapping attack patterns.

  • Essential for detecting and responding to intrusions.

Procedures

  1. Develop a standard installation image.

  2. Address vulnerabilities post-attack.

  3. Retrieve all volatile data.

  4. Acquire compromised drives.

  5. Compare original and forensic images to identify discrepancies.

Investigating Virtual Networks

  • Virtual switches differ from physical ones and introduce complications like shared MAC addresses across networks.

  • Key tools for investigation:

    • Wireshark

    • Network Miner

Conclusion

  • Continuous adaptation and learning are crucial for effective forensic analysis in virtual and network environments.