A B S T R A C T
With the growth of virtualization and cloud computing, more and more forensic investigations
rely on being able to perform live forensics on a virtual machine using virtual
machine introspection (VMI). Inspecting a virtual machine through its hypervisor enables
investigation without risking contamination of the evidence, crashing the computer, etc.
To further access to these techniques for the investigator/researcher we have developed a
new VMI monitoring language. This language is based on a review of the most commonly
used VMI-techniques to date, and it enables the user to monitor the virtual machine’s
memory, events and data streams. A prototype implementation of our monitoring system
was implemented in KVM, though implementation on any hypervisor that uses the
common x86 virtualization hardware assistance support should be straightforward. Our
prototype outperforms the proprietary VMWare VProbes in many cases, with a maximum
performance loss of 18% for a realistic test case, which we consider acceptable. Our
implementation is freely available under a liberal software distribution license.
© 2014 Digital Forensics ResearchWorkshop. Published by Elsevier Ltd. All rights reserved
[aio_button align=”none” animation=”none” color=”red” size=”small” icon=”none” text=”انجام مقاله علمی پژوهشی و ISI در این زمینه” target=”_blank” relationship=”dofollow” url=”http://payannameha.ir/?p=796″]
[aio_button align=”none” animation=”none” color=”orange” size=”small” icon=”none” text=”دریافت سایر مقالات در این زمینه” target=”_blank” relationship=”dofollow” url=”http://payannameha.ir/?page_id=297″]
[aio_button align=”none” animation=”none” color=”blue” size=”small” icon=”none” text=”انجام پایان نامه در این حوزه” relationship=”dofollow” url=”http://payannameha.ir/?page_id=3206″]
[aio_button align=”none” animation=”none” color=”pink” size=”small” icon=”none” text=”انجام پروپوزال در این حوزه” target=”_blank” relationship=”dofollow” url=”http://payannameha.ir/?page_id=3206″]
[aio_button align=”none” animation=”none” color=”green” size=”small” icon=”none” text=”ترجمه تخصصی این مقاله” target=”_blank” relationship=”dofollow” url=”http://payannameha.ir/?p=154″]
جهت خرید فایل به انتهای صفحه مراجعه نمایید
کد محصول : شماره 180
[aio_button align=”none” animation=”none” color=”green” size=”small” icon=”none” text=”پرداخت کارت به کارت” target=”_blank” relationship=”dofollow” url=”http://jozvekade.ir/?page_id=1139″]