Electronic crime investigations in a virtualised environment: a forensic process and prototype for evidence collection and analysis. Issue 2 (4th March 2018)

• Record Type: Journal Article
• Authors: Ahmad, Ijaz; Abbas, Haider; Raza, Asad; Choo, Kim-Kwang Raymond; Sajid, Anam; Pasha, Maruf; Khan, Farrukh Aslam
• Is Part Of: Australian journal of forensic sciences. Volume 50:Issue 2(2018)
• Page Start: 183
• Page End: 208
• Publication Date: 2018-03-04
• Subjects: Virtual machine traces -- Windows registry analysis -- forensic evidence; Law -- Australia -- Periodicals; Forensic sciences -- Periodicals; Forensic Medicine -- Periodicals; 363.2505
• DOI: 10.1080/00450618.2016.1229814
• Languages: English
• ISSNs: 0045-0618

Abstract

Abstract: The constant evolution of virtualisation technologies and the availability of anti-forensic techniques and tools complicate efforts by forensic investigators to investigate a crime or a cyber security incident. Forensic collection can be complicated and requires significant efforts to investigate incidents involving contemporary technologies (e.g. crime launched from a virtual machine and there had been attempts to erase evidence after the incident). This paper presents a forensic process to collect and analyse traces of a virtual machine and its corresponding manager, recorded across multiple sources including the file system, Windows registry, history, and log files from a forensic viewpoint. To demonstrate utility of the forensic mechanism, the Virtual Machine Forensic Artefact Collector (VMFAC) prototype is developed and presented in this paper.