Name
Abstract | ||
|---|---|---|
As the use of virtual machine environments increases, virtual machines forensics is becoming more and more important and emergent. Current forensics solutions to virtualized environments mainly focus on static data analysis, which cannot provide a complete picture of events. In this paper, a novel method used for KVM (Kernel-based Virtual Machine) virtual machine memory forensics has been proposed. By analyzing the memory image of a host machine, active virtual machines can be detected, and a complete picture of the virtual machine's states can be also obtained, such as running processes, loaded modules, network connections, registry, system logs, user accounts, services, hook analysis info and so on. The proposed method has been proved to be more effective in machines with current mainstream CPUs and Fedora version 16-19 for both 32-bit and 64-bit. |
Year | DOI | Venue |
|---|---|---|
2014 | 10.1109/CIS.2014.72 | CIS |
Keywords | Field | DocType |
forensics, virtual machine, KVM, volatile memory acquisition, memory analysis | Virtual machine,Temporal isolation among virtual machines,Computer science,Virtual memory,Data diffusion machine,Full virtualization,Virtual finite-state machine,Memory footprint,Operating system,Kernel virtual address space,Embedded system | Conference |
Citations | PageRank | References |
0 | 0.34 | 7 |
Authors | ||
3 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| Shuhui Zhang | 1 | 32 | 4.82 |
| Lianhai Wang | 2 | 41 | 10.98 |
| Xiaohui Han | 3 | 17 | 5.41 |