Virtualization and Forensics: A Digital Forensic Investigator's Guide to Virtual Environments

Virtualization and Forensics: A Digital Forensic Investigator's Guide to Virtual Environments

Volumn , Issue , 2010, Pages 1-254

  Barrett, Diane ^a   Kipper, Gregory ^a  

^a NONE

Author keywords

[No Author keywords available]

Indexed keywords

EID: 84920476925     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.1016/C2009-0-61118-1     Document Type: Book

References (129)

1. K. Adams and O. Agesen (2006) A comparison of software and hardware techniques for x86 virtualization. http://www.vmware.com/pdf/asplos235_adams.pdf Retrieved from
2. D. Dubie (2010, January 20) Gartner: CIOs look to lighter-weight, social technologies to transform IT. Network World http://www.cio.com.au/article/333035/gartner_cios_look_lighter-weight_social_technologies_transform_it?eid=-1533 Retrieved from
3. P. Ferrie (2007) Attacks on more virtual machine emulators. www.symantec.com/avcenter/reference/Virtual_Machine_Threats.pdf Retrieved from
4. B. Gammage and A. Jump (2009, February 17) Emerging technology analysis: hosted virtual desktops. Gartner group http://www.gartner.com/DisplayDocument?ref=g_search&id=887912&subref=simplesearch Retrieved from
5. T. Garfinkel and M. Rosenblum (2005) When virtual is harder than real: security challenges in virtual machine based computing environments. Proceedings of the 10th Workshop on Hot Topics in Operating Systems June 12–15. Santa Fe, NM
6. E. Messmer (2009, October 20) Gartner predicts nearly half of server workloads will be virtualized. Network World http://www.networkworld.com/news/2009/102009-gartner-server-virtualization.html Retrieved from
7. A. Murphy Virtualization defined – eight different ways. F5. http://www.f5.com/pdf/white-papers/virtualization-defined-wp.pdf (n.d.) Retrieved from
8. E. Orakwue (2009, February) Rise of the virtual machine. ISSA Journal http://www.issa.org/Library/Journals/2009/February/Orakwue-Rise%20of%20the%20Virtual%20Machine.pdf Retrieved from
9. Paravirtualization API version 2.5. Copyright 2005, 2006. VMware, Inc. www.vmware.com/pdf/vmi_specs.pdf Retrieved from
10. Popek, G. J., & Goldberg, R. P. (n.d.) Formal requirements for virtualizable third generation architectures. Los Angeles: University of California, Honeywell Information Systems and Harvard University
11. VMWare, Inc. (n.d.). Understanding full virtualization, paravirtualization, and hardware assist. Retrieved from www.vmware.com/files/pdf/VMware_paravirtualization.pdf
12. Virtual Data Center E-Zine, (2010, January), Volume 18. Retrieved from http://searchdatacenter.techtarget.com/generic/0,295582,sid80_gci1313630,00.html
13. www.scribd.com/doc/17770659/VirtualizationReport-for-Seminar
14. http://www.cio.com.au/article/333035/gartner_cios_look_lighter-weight_social_technologies_transform_it?eid=-1533
15. http://www.gartner.com/DisplayDocument?id=5651
16. www.wmware.com
17. www.parallels.com
18. http://www.microsoft.com/windows/virtual-pc/
19. http://www.virtualbox.org/manual/UserManual.html
20. http://www.xen.org/support/documentation.html
21. Frost and Sullivan (2009, November 30) Although in its nascent stage, the future of virtualization market in India looks promising, notes Frost & Sullivan. Frost & Sullivan http://www.frost.com/prod/servlet/press-release.pag?docid=185829213 Retrieved from
22. D. Kusnetzky (2007, June) Virtualization and virtual machine software. We help you to choose the best VM. Hacking IT Security Magazine
23. Sturdevant, C. (2009, November 17). Is virtualization becoming the turducken of the IT World? eWeek.com. Retrieved from http://www.eweek.com/c/a/Virtualization/Is-Virtualization-Becoming-the-Turducken-of-the-IT-World-231429/
24. Y. Suzuki and M. Moriyama (2006, March) What issues does storage virtualization solve? The benefits of Hitachi's virtualization solutions. Techrepublic.com http://whitepapers.techrepublic.com.com/abstract.aspx?docid=344989 Retrieved from
25. B. Peterson (2007, October 10) SAN-based storage virtualization: five benefits for your customers. Search Storage Channel.com http://searchstoragechannel.techtarget.com/tip/0,289483,sid98_gci1274842,00.html Retrieved from
26. C. Preimesberger (2009, November 23) 10 key differences between desktop and server virtualization deployments. eWeek.com http://www.eweek.com/c/a/Data-Storage/10-Key-Differences-Between-Desktop-and-Server-Virtualization-Deployments-152781/ Retrieved from
27. Oracle (2009, August) Introduction to workload manager. Chapter 6 in: Database Oracle Clusterware and Oracle Real Application Clusters Administration and Deployment Guide http://download.oracle.com/docs/cd/B19306_01/rac.102/b14197/hafeats.htm#RACAD7120 Retrieved from
28. www.wmware.com
29. www.wmware.com
30. www.parallels.com
31. http://www.microsoft.com/windows/virtual-pc/
32. http://www.virtualbox.org/manual/UserManual.html
33. http://www.xen.org/support/documentation.html
34. http://www.linux-forensics.com/
35. http://www.vmware.com/appliances/directory/213673
36. http://www.vmware.com/appliances/directory/813
37. http://www.e-fense.com/helix3pro
38. http://www.vmware.com/appliances/directory/57815
39. http://www.caine-live.net/
40. D. Bem and E. Huebner (2007, Fall) Computer forensic analysis in a virtual environment. International Journal of Digital Evidence 6(2)
41. D. Marshall (2008) Parallels virtuozzo containers offers 350 templates. InfoWorld virtualization report Retrieved from http://weblog.infoworld.com/virtualization/archives/2008/02/parallels_virtu.html
42. Y. Zhang, X. Wang and L. Hong (2000) Portable desktop applications based on P2P transportation and virtualization. Proceedings from LISA '08: The 22nd Large Installation System Administration Conference
43. http://www.mojopac.com/enterprise/products/index.html RingCube MojoPac
44. http://www.moka5.com/products/index.html LivePCs. Moka5
45. L. Fiering, M.A. Silver, B. Gammage, J. Unsworth and D.M. Smith (2007) Cool vendors in PC technologies, 2007. Gartner, Inc www.gartner.com/DisplayDocument?id=502005 Retrieved from
46. http://technet.microsoft.com/en-us/bb738372.aspx Run IT on a virtual hard disk – test drive program. Microsoft TechNet. Retrieved from
47. http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx Virtualization from the datacenter to the desktop. Microsoft TechNet. Retrieved from
48. www.wmware.com
49. www.parallels.com
50. http://www.xen.org/support/documentation.html
51. Deliver IT as an on-demand service: Transform datacenters into delivery centers. http://www.citrix.com/English/ps2/products/product.asp?contentID=683711 Citrix. Retrieved from
52. Project kensho v1.3 technology preview. http://community.citrix.com/display/xs/Kensho Citrix Community
53. http://www.vmware.com/appliances/getting-started/learn/faq.html
54. The free portable privacy machine. http://www.metropipe.net/ppm.php?SID=4e38766ea6a3fab4792ced91b2bdbe48 MetroPipe
55. Bares, R. (2009). Hiding in a virtual world using unconventionally installed operating systems. IEEE International Conference on Intelligence and Security Informatics. Dallas, TX. Retrieved from http://ieeexplore.ieee.org/Xplore/login.jsp?url=http%3A%2F%2Fieeexplore.ieee.org%.2Fiel5%2F5089313%2F5137253%2F05137326.pdf%3Farnumber%3D5137326%26authDecision=-203
56. Microsoft Corporation (2009) Virtual hard disk image format specification download.microsoft.com/.../Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc Retrieved from
57. A. Spruill and C. Pavan (2007) Tackling the U3 trend with computer forensics. Journal of Digital Investigation 4(1), http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B7CW4-4N440CB-1&_user=8303832&_coverDate=03%2F31%2F2007&_rdoc=1&_fmt=high&_orig=search&_sort=d&_docanchor=&view=c&_searchStrId=1285052568&_rerunOrigin=google&_acct=C000000593&_version=1&_urlVersion=0&_userid=8303832&md5=a1cb63ae1f78f6b950cc2a28c540f4ed Retrieved from
58. What Files Make Up a Virtual Machine? VMWare. http://www.vmware.com/support/ws55/doc/ws_learning_files_in_a_vm.html
59. H. Carvey (2009) Windows forensic analysis DVD toolkit 2nd ed. Burlington, MA: Syngress
60. Bares, R. (2009). Hiding in a virtual world using unconventionally installed operating systems. IEEE International Conference on Intelligence and Security Informatics. Dallas, TX. Retrieved from http://ieeexplore.ieee.org/Xplore/login.jsp?url=http%3A%2F%2Fieeexplore.ieee.org%.2Fiel5%2F5089313%2F5137253%2F05137326.pdf%3Farnumber%3D5137326&authDecision=-203
61. E.M. Fiterman and J.D. Durick (2010) Ghost in the machine: Forensic evidence collection in the virtual environment. Digital Forensics Magazine 2 73-77
62. Stagner, H. (2007, February 20). How to examine the compromised Microsoft Virtual Server 2005 host server after a security breach. SearchServerVirtualization.com. Retrieved from http://searchservervirtualization.techtarget.com/tip/0,289483,sid94_gci1244430,00.html
63. VMware GSX server documentation http://www.vmware.com/support/gsx25/doc/performance_memory_reserved_gsx.html
64. VMware patents applied for http://www.patentstorm.us/attorney-applications/VMware__Inc_/241723/1.html
65. http://searchservervirtualization.techtarget.com/tip/0,289483,sid94_gci1244430,00.html
66. H. Carvey (2009) Windows forensic analysis: DVD toolkit. 2nd ed. Burlington, MA: Syngress
67. P. Ferrie (2007) Attacks on more virtual machine emulators. Symantic Advanced Threat Research www.symantec.com/avcenter/reference/Virtual_Machine_Threats.pdf Retrieved from
68. H. Parsonage (September 2008, Updated November 2009) The meaning of linkfiles in forensic examinations http://computerforensics.parsonage.co.uk/downloads/TheMeaningofLIFE.pdf Retrieved from
69. B. Shavers (2008) Virtual machine forensics, a discussion of virtual machines related to forensics analysis. Forensic Focus http://www.forensicfocus.com Retrieved from
70. Stagner, H. (2007). How to detect rogue virtual machines on a network. SearchServerVirtualization.com. Retrieved from http://searchservervirtualization.techtarget.com/tip/0,289483,sid94_gci1247530_mem1,00.html. Contributor Accessed 14.03.07
71. N. Weilbacher (2006) Evidentiary value of link files. Forensic Focus http://www.forensicfocus.com/link-file-evidentiary-value Retrieved from
72. C. Wolf (2007) Inventorying virtual hard disk files on a server or domain. Virtualization Review http://virtualizationreview.com/articles/2007/05/01/inventorying-virtualhard-disk-files-on-a-server-or-domain.aspx Retrieved from
73. C. Wolf (2008) Rogue VMs be very afraid. Virtualization Review http://virtualizationreview.com/articles/2008/06/01/rogue-vms-be-very-afraid.aspx Accessed 01.06.08. Retrieved from
74. Understanding virtual machine snapshots in VMware ESX, VMware's KB article 1015180, http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1015180
75. What files make up a virtual machine? http://www.vmware.com/support/ws55/doc/ws_learningfiles_in_a_vm.html
76. Understanding virtual machine snapshots in VMware ESX. http://kb.vmware.com/selfservice/microsites/search.do%3Flanguage=en_US%26cmd=displayKC%26externalId=1015180
77. http://www.virtualizationdaily.com/archives/73_how-to-convert-a-vmware-virtual-appliance-to-work-with-parallels.html
78. http://vmtoolkit.com/
79. http://viethak.com/2009/11/27/Convert-VMDK-to-VHD-Virtual-Disk-or-Vice-versa-Using-StarWind-Image-Converter.html
80. A. Barrett (2008) VMware makes the case for PCI DSS compliance. SearchServerVirtualization.com Retrieved from http://searchservervirtualization.techtarget.com/news/article/0,289142,sid94_gci1338681,00.html. Accessed 12.11.08
81. D. Bem and E. Huebner (2007, Fall) Computer forensic analysis in a virtual environment. International Journal of Digital Evidence 6(2), www.ijde.org
82. J. Fegreus (2009) Automating D2D backup of virtual machines. InfoStor http://www.infostor.com/index/articles/display/articles/infostor/backup-and_recovery/disk-based-backup/lab-review__automating.html Accessed 01.10.09 Retrevied from
83. W. Hau, R. Araujo, V. Chudgar, R. Hustad and C. Chaubal (2009) How virtualization affects PCI DSS Part 1: Mapping PCI requirements and virtualization. VMware http://www.vmware.com/files/pdf/technology/mapping_pci_req_part1_wp.pdf Retrieved from
84. W. Hau, R. Araujo, V. Chudgar, R. Hustad and C. Chaubal (2010) How virtualization affects PCI DSS Part 2: a review of the top five issues. VMware http://www.vmware.com/files/pdf/technology/review_top5_issues_wp.pdf Retrieved from
85. D. Kusnetzky (2007) Virtual machines you have to see them to manage them. Kusnetsky group http://www.virtual-strategy.com/Dan-Kusnetzky/Virtual-Machines-You-Have-to-See-Them-to-Manage-Them.html Retrieved from
86. R. Miller (2008) Virtual machines can be an e-discovery nightmare. Fierce Content Management http://www.fiercecontentmanagement.com/story/virtual-machines-can-be-e-discovery-nightmare/2008-09-11 Retrieved from
87. D. Mortman (2009) How to find virtual machines for greater virtualization compliance. Information Security Magazine http://searchsecurity.techtarget.com/tip/0,289483,sid14_gci1359272,00.html Accessed 07.08.09 Retrieved from
88. P. Shread (2008, September 10) Virtual machines pose e-discovery risk, vendor says. EnterpriseStorageForum http://www.enterprisestorageforum.com/article.php/3770706 Retrieved from
89. Distributed Management Task Force, Inc. DMTF Creates Open Standard for System Virtualization Management. http://www.dmtf.org/newsroom/pr/view?item_key=70d5d3ba78d39488626f838397a3d1e9812e5d40
90. How Virtualization Affects EDD Collection (Law.com)
91. VM Sprawl – prevention rather than cure. http://www.techworld.com/virtualisation/news/index.cfm?newsID=115876&pagtype Accessed 17.05.09
92. Data center virtualization: Four steps to compliance, Special to SearchCIOMidmarket.com, http://searchcompliance.techtarget.com/tip/0,289483,sid195_gci1340735_mem1,00.html. Accessed 11.06.08
93. D.J. Capelis (2007) Virtualization: Enough holes to work Vegas. Defcon 15, Las Vegas http://www.dc414.org/download/confs/defcon15/Speakers/Capelis/dc-15-%20capelis.pdf Retrieved from
94. A. Cargile (2009) Hypervisor security concerns. The Coffee Desk http://thecoffeedesk.com/news/index.php/2009/12/01/hypervisor-security-concerns/ Retrieved from
95. S. Charette (2009) How not to detect virtualization http://charette.no-ip.com:81/programming/2009-12-30_Virtualization/ Retrieved from
96. J. Kirch (Ed.) (2007) Virtual machine security guidelines (version 1) The Center for Internet Security http://www.cisecurity.org/tools2/vm/CIS_VM_Benchmark_v1.0.pdf Retrieved from
97. P. Ferrie (2007) Attacks on more virtual machine emulators. Symantic Advanced Threat Research www.symantec.com/avcenter/reference/Virtual_Machine_Threats.pdf Retrieved from
98. video Hankeln (2008) http://sanbarrow.com/latest-videoesxi-exe.html Retrieved from
99. S.T. King, P.M. Chen, Y.-M. Wang, C. Verbowski, H.J. Wang and J.R. Lorch (2006) SubVirt: implementing malware with virtual machines. http://portal.acm.org/citation.cfm?id=1130383 Retrieved from
100. T. Liston and E. Skoudis (2006) On the cutting edge: Thwarting virtual machine. IntelGuardians http://handlers.sans.org/tliston/ThwartingVMDetection_Liston_Skoudis.pdf Retrieved from
101. S. Moulton (2008, August) Data recovery and information about solid state devices and NAND flash memory. Video posted to www.youtube.com/view_play_list?p=C337FACBF12BDCE2
102. J. Rutkowska (2004, November) Red Pill… or how to detect VMM using (almost) one CPU instruction. http://invisiblethings.org/papers/redpill.html Retrieved from
103. Siebert, E. (2010, January 7). How to steal a virtual machine and its data in 3 easy steps. SearchVMware.com. Retrieved from http://searchvmware.techtarget.com/news/article/0,289142,sid179_gci1378347,00.html
104. STIG Security Technical Implementation Guides (2001) Information Assurance Support Environment. http://iase.disa.mil/stigs/stig/index.html Retrieved from
105. Vanover, R. (2010). Breaking down the vStorage Virtual Machine File System (VMFS). SearchVMware.com. Retrieved from http://searchvmware.techtarget.com/tip/0,289483,sid179_gci1368383_mem1,00.html
106. VMware (2006) Virtualization: architectural considerations and other evaluation criteria. http://www.vmware.com/pdf/virtualization_considerations.pdf
107. VMware knowledge base Some space missing from a new VMFS data store due to hidden files. http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1001618
108. Install and Configure ESX server http://virtualizationinformation.com/docs/Notes%20on%20VI%203.pdf
109. Defragmenting virtual machine files http://itknowledgeexchange.techtarget.com/virtualization-pro/defragmenting-virtual-machine-disk-files/
110. VMware, Randell. August 2008 presentation to the Arizona Security Practitioners Forum (AZSPF)
111. Xen Wiki Hypercall formal definition
112. E. Haletky (2009) VMware vSphere and Virtual Infrastructure Security Prentice Hall
113. Network segmentation in virtualized environments. VMware white paper. http://www.vmware.com/files/pdf/network_segmentation.pdf
114. InfoWorld.com InfoClipz: Cloud Computing. April 2009
115. M. Beckman (2009, September) Cloud computing deep dive. InfoWorld
116. S. Amoah (02/2010) Cloud computing and network forensics in the eyes of computer forensic examiner. Decision Group
117. D. Navetta (September 12, 2009) Legal implications of cloud computing. LLRX.com
118. Security guidance for critical areas of focus in cloud computing. Cloud Security Alliance
119. J. Coates and J. Jarrat (1989) What futurists believe Mt. Airy, MD: Lomond Publication, Inc
120. J. Stokes (2009, May 6) The future of virtualization: a view from the front lines. ars technica http://arstechnica.com/business/news/2009/05/the-future-of-virtualization-a-view-from-the-front-lines.ars Retrieved from
121. O. Kharif (2008, April 9) Virtualization goes mobile. BusinessWeek Online http://www.businessweek.com/technology/content/apr2008/tc20080421_235517.htm?chan=technology_technology%2Bindex%2Bpage_top%2Bst Retrieved from
122. VMWare Mobile Virtualization Platform http://www.vmware.com/products/mobile/ (n.d.). Retrieved from
123. J. Tozzi (2009, October 23) The rise of the Homepreneur. http://www.businessweek.com/smallbiz/content/oct2009/sb20091023_263258.htm Retrieved from
124. NetworkWorld Asia Staff (2009, September 4) Mobile phone virtualization to really enable workers and IT staff. NetworkWorldAsia http://www.networksasia.net/content/mobile-phone-virtualization-really-enable-workers-and-it-staff Retrieved from
125. D. Goldman (2010, February 4) Tablet wars: Google looks to take on Apple iPad. CNNMoney.com http://money.cnn.com/2010/02/04/technology/apple_ipad_google_chrome/index.htm Retrieved from
126. R. Mark (2010, February 4) House Passes Cyber-Security Act. eWeek.com http://www.eweek.com/c/a/Government-IT/House-Passes-Cybersecurity-Act-682741/ Retrieved from
127. S. Shankland (2009, October 20) Gartner: Brace yourself for cloud computing. CNET news http://news.cnet.com/8301-30685_3-10378782-264.html Retrieved from
128. IBM (2005, June) An architectural blueprint for autonomic computing. http://www-03.ibm.com/autonomic/pdfs/AC%20Blueprint%20White%20Paper%20V7.pdf Retrieved from
129. P. Horn (2001, October 15) How autonomic computing will reshape IT. CNET news http://news.cnet.com/2010-1071-281578.html Retrieved from