Any one can give some ideas about what are the major differences between Virtualization forensics(analysis) and traditional forensic investigation methods? According to you experience. Your comments on this article is very much appreciated. Thanks D
Your comments on this article is very much appreciated.
What article ?
Oh Sorry,joachimm.Lets say "comments about this post"…thanks
Stranded forensic analysis methodology involves four key steps. They are, preserving the chin of custody,data acquisition,analyzing the acquired data and determining the answer for the aforementioned question who did what, when,where and how. These steps can be directly affected in a virtual machine forensic investigation. It can make either all four steps nearly impossible or merely possible but difficult.
Any one can give some ideas about what are the major differences between Virtualization forensics(analysis) and traditional forensic investigation methods?
OK next question what type of virtualisation, e.g. Virtual Machine (system emulation)e.g. VMWare, executable virtualization (Java JRE/.Net CRL), other type of virtualization ?
I'm assuming you're addressing the Virtual Machine (system emulation) but let's be sure.
Virtualized environments are not terribly different than "standard" (hate that term) forensics. Still have to develop a method and course of action for the investigation.
What have your experiences been so far?
These steps can be directly affected in a virtual machine forensic investigation.
So can they on a physical machine. You always should take mitigating factors into account.
OK next question what type of virtualisation, e.g. Virtual Machine (system emulation)e.g. VMWare, executable virtualization (Java JRE/.Net CRL), other type of virtualization ?
Lets say "Virtualbox"
"You always should take mitigating factors into account"
Wut are the mitigating factors??
"You always should take mitigating factors into account"
Wut are the mitigating factors??
With mitigating factors I mean a wide variety of things (just a short list)
* behaviour of applications and how artefacts e.g. timestamps came to be
* who had access to the (virtual) system/who didn't
* could the systems have been cleared of artefacts or artefacts been falsified/modified
* artefacts collected from other sources
* etc.