Virtualization and forensics

Virtualization and Forensics

Volumn , Issue , 2010, Pages

  Barrett, Diane ^a   Kipper, Gregory ^a  

^a NONE

Author keywords

[No Author keywords available]

Indexed keywords

EID: 85013744824     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.1016/C2009-0-61118-1     Document Type: Book

References (129)

1. Adams K., Agesen O. A comparison of software and hardware techniques for x86 virtualization. Retrieved from. http://www.vmware.com/pdf/asplos235_adams.pdf.
2. Dubie D. Gartner: CIOs look to lighter-weight, social technologies to transform IT. Network World 2010, January 20, Retrieved from. http://www.cio.com.au/article/333035/gartner_cios_look_lighter-weight_social_technologies_transform_it%3Feid=-1533.
3. Ferrie P. Attacks on more virtual machine emulators Retrieved from. http://www.symantec.com/avcenter/reference/Virtual_Machine_Threats.pdf.
4. Gammage B., Jump A. Emerging technology analysis: hosted virtual desktops. Gartner group 2009, February 17, Retrieved from. http://www.gartner.com/DisplayDocument%3Fref=g_search%26id=887912%26subref=simplesearch.
5. Garfinkel T., Rosenblum M. When virtual is harder than real: security challenges in virtual machine based computing environments. Proceedings of the 10th Workshop on Hot Topics in Operating Systems 2005, June 12-15. Santa Fe, NM.
6. Messmer E. Gartner predicts nearly half of server workloads will be virtualized. Network World 2009, October 20, Retrieved from. http://www.networkworld.com/news/2009/102009-gartner-server-virtualization.html.
7. Murphy A. Virtualization defined - eight different ways. F5 (n.d.) Retrieved from. http://www.f5.com/pdf/white-papers/virtualization-defined-wp.pdf.
8. Orakwue E. Rise of the virtual machine. ISSA Journal 2009, February, Retrieved from. http://www.issa.org/Library/Journals/2009/February/Orakwue-Rise%20of%20the%20Virtual%20Machine.pdf.
9. Copyright 2005, 2006. VMware, Inc Paravirtualization API version 2.5., Retrieved from. http://www.vmware.com/pdf/vmi_specs.pdf.
10. Popek, G. J., & Goldberg, R. P. (n.d.) Formal requirements for virtualizable third generation architectures. Los Angeles: University of California, Honeywell Information Systems and Harvard University.
11. VMWare, Inc. (n.d.). Understanding full virtualization, paravirtualization, and hardware assist. Retrieved from. http://www.vmware.com/files/pdf/VMware_paravirtualization.pdf.
12. Virtual Data Center E-Zine, (2010, January), Volume 18. Retrieved from. http://searchdatacenter.techtarget.com/generic/0,295582,sid80_gci1313630,00.html.
13. http://www.scribd.com/doc/17770659/VirtualizationReport-for-Seminar.
14. http://www.cio.com.au/article/333035/gartner_cios_look_lighter-weight_social_technologies_transform_it%3Feid=-1533.
15. http://www.gartner.com/DisplayDocument%3Fid=5651.
16. http://www.wmware.com.
17. http://www.parallels.com.
18. http://www.microsoft.com/windows/virtual-pc/.
19. http://www.virtualbox.org/manual/UserManual.html.
20. http://www.xen.org/support/documentation.html.
21. Frost, Sullivan Although in its nascent stage, the future of virtualization market in India looks promising, notes Frost & Sullivan. Frost & Sullivan 2009, November 30, Retrieved from. http://www.frost.com/prod/servlet/press-release.pag%3Fdocid=185829213.
22. Kusnetzky D. Virtualization and virtual machine software. We help you to choose the best VM. Hacking IT Security Magazine 2007, June.
23. Sturdevant, C. (2009, November 17). Is virtualization becoming the turducken of the IT World? eWeek.com. Retrieved from. http://www.eweek.com/c/a/Virtualization/Is-Virtualization-Becoming-the-Turducken-of-the-IT-World-231429/.
24. Suzuki Y., Moriyama M. What issues does storage virtualization solve? The benefits of Hitachi's virtualization solutions. Techrepublic.com 2006, March, Retrieved from. http://whitepapers.techrepublic.com.com/abstract.aspx?docid=344989.
25. Peterson B. SAN-based storage virtualization: five benefits for your customers. Search Storage Channel.com 2007, October 10, Retrieved from. http://searchstoragechannel.techtarget.com/tip/0,289483,sid98_gci1274842,00.html.
26. Preimesberger C. 10 key differences between desktop and server virtualization deployments. eWeek.com 2009, November 23, Retrieved from. http://www.eweek.com/c/a/Data-Storage/10-Key-Differences-Between-Desktop-and-Server-Virtualization-Deployments-152781/.
27. Oracle Introduction to workload manager. Chapter 6 in: Database Oracle Clusterware and Oracle Real Application Clusters Administration and Deployment Guide 2009, August, Retrieved from. http://download.oracle.com/docs/cd/B19306_01/rac.102/b14197/hafeats.htm#RACAD7120.
28. http://www.wmware.com.
29. http://www.wmware.com.
30. http://www.parallels.com.
31. http://www.microsoft.com/windows/virtual-pc/.
32. http://www.virtualbox.org/manual/UserManual.html.
33. http://www.xen.org/support/documentation.html.
34. http://www.linux-forensics.com/.
35. http://www.vmware.com/appliances/directory/213673.
36. http://www.vmware.com/appliances/directory/813.
37. http://www.e-fense.com/helix3pro.
38. http://www.vmware.com/appliances/directory/57815.
39. http://www.caine-live.net/.
40. Bem D., Huebner E. Computer forensic analysis in a virtual environment. International Journal of Digital Evidence 2007, Fall, 6(2).
41. Marshall D. Parallels virtuozzo containers offers 350 templates. InfoWorld virtualization report 2008, Retrieved from http://weblog.infoworld.com/virtualization/archives/2008/02/parallels_virtu.html.
42. Zhang Y., Wang X., Hong L. Portable desktop applications based on P2P transportation and virtualization. Proceedings from LISA '08: The 22nd Large Installation System Administration Conference 2000.
43. RingCube MojoPac. http://www.mojopac.com/enterprise/products/index.html.
44. LivePCs. Moka5. http://www.moka5.com/products/index.html.
45. Fiering L., Silver M.A., Gammage B., Unsworth J., Smith D.M. Cool vendors in PC technologies, 2007. Gartner, Inc 2007, Retrieved from. http://www.gartner.com/DisplayDocument?id=502005.
46. Run IT on a virtual hard disk - test drive program. Microsoft TechNet. Retrieved from. http://technet.microsoft.com/en-us/bb738372.aspx.
47. Virtualization from the datacenter to the desktop. Microsoft TechNet. Retrieved from. http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx.
48. http://www.wmware.com.
49. http://www.parallels.com.
50. http://www.xen.org/support/documentation.html.
51. Deliver IT as an on-demand service: Transform datacenters into delivery centers Citrix. Retrieved from. http://www.citrix.com/English/ps2/products/product.asp?contentID=683711.
52. Project kensho v1.3 technology preview Citrix Community. http://community.citrix.com/display/xs/Kensho.
53. http://www.vmware.com/appliances/getting-started/learn/faq.html.
54. The free portable privacy machine MetroPipe. http://www.metropipe.net/ppm.php?SID=4e38766ea6a3fab4792ced91b2bdbe48.
55. Bares, R. (2009). Hiding in a virtual world using unconventionally installed operating systems. IEEE International Conference on Intelligence and Security Informatics. Dallas, TX. Retrieved from http://ieeexplore.ieee.org/Xplore/login.jsp?url=http%3A%2F%2Fieeexplore.ieee.org%.2Fiel5%2F5089313%2F5137253%2F05137326.pdf%3Farnumber%3D5137326%26authDecision=-203.
56. Virtual hard disk image format specification 2009, Microsoft Corporation, Retrieved from. http://download.microsoft.com/../Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc.
57. Spruill A., Pavan C. Tackling the U3 trend with computer forensics. Journal of Digital Investigation 2007, 4(1). Retrieved from. http://www.sciencedirect.com/science?_ob=ArticleURL%26_udi=B7CW4-4N440CB-1%26_user=8303832%26_coverDate=03%2F31%2F2007%26_rdoc=1%26_fmt=high%26_orig=search%26_sort=d%26_docanchor=%26view=c%26_searchStrId=1285052568%26_rerunOrigin=google%26_acct=C000000593%26_version=1%26_urlVersion=0%26_userid=8303832%26md5=a1cb63ae1f78f6b950cc2a28c540f4ed.
58. What Files Make Up a Virtual Machine? VMWare. http://www.vmware.com/support/ws55/doc/ws_learning_files_in_a_vm.html.
59. Carvey H. Windows forensic analysis DVD toolkit 2009, Syngress, Burlington, MA. 2nd ed.
60. Bares, R. (2009). Hiding in a virtual world using unconventionally installed operating systems. IEEE International Conference on Intelligence and Security Informatics. Dallas, TX. Retrieved from http://ieeexplore.ieee.org/Xplore/login.jsp?url=http%3A%2F%2Fieeexplore.ieee.org%.2Fiel5%2F5089313%2F5137253%2F05137326.pdf%3Farnumber%3D5137326&authDecision=-203.
61. Fiterman E.M., Durick J.D. Ghost in the machine: Forensic evidence collection in the virtual environment. Digital Forensics Magazine 2010, 2:73-77.
62. Stagner, H. (2007, February 20). How to examine the compromised Microsoft Virtual Server 2005 host server after a security breach. SearchServerVirtualization.com. Retrieved from. http://searchservervirtualization.techtarget.com/tip/0,289483,sid94_gci1244430,00.html.
63. VMware GSX server documentation. http://www.vmware.com/support/gsx25/doc/performance_memory_reserved_gsx.html.
64. VMware patents applied for. http://www.patentstorm.us/attorney-applications/VMware__Inc_/241723/1.html.
65. http://searchservervirtualization.techtarget.com/tip/0,289483,sid94_gci1244430,00.html.
66. Carvey H. Windows forensic analysis: DVD toolkit 2009, Syngress, Burlington, MA. 2nd ed.
67. Ferrie P. Attacks on more virtual machine emulators. Symantic Advanced Threat Research 2007, Retrieved from. http://www.symantec.com/avcenter/reference/Virtual_Machine_Threats.pdf.
68. Parsonage H. The meaning of linkfiles in forensic examinations September 2008, Updated November 2009, Retrieved from. http://computerforensics.parsonage.co.uk/downloads/TheMeaningofLIFE.pdf.
69. Shavers B. Virtual machine forensics, a discussion of virtual machines related to forensics analysis. Forensic Focus 2008, Retrieved from. http://www.forensicfocus.com.
70. Stagner, H. (2007). How to detect rogue virtual machines on a network. Retrieved from. Contributor Accessed 14.03.07. http://searchservervirtualization.techtarget.com/tip/0,289483,sid94_gci1247530_mem1,00.html.
71. Weilbacher N. Evidentiary value of link files. Forensic Focus 2006, Retrieved from. http://www.forensicfocus.com/link-file-evidentiary-value.
72. Wolf C. Inventorying virtual hard disk files on a server or domain. Virtualization Review 2007, Retrieved from. http://virtualizationreview.com/articles/2007/05/01/inventorying-virtualhard-disk-files-on-a-server-or-domain.aspx.
73. Wolf C. Rogue VMs be very afraid. Virtualization Review 2008, Retrieved from, Accessed 01.06.08. http://virtualizationreview.com/articles/2008/06/01/rogue-vms-be-very-afraid.aspx.
74. Understanding virtual machine snapshots in VMware ESX, VMware's KB article 1015180,. http://kb.vmware.com/selfservice/microsites/search.do%3Flanguage=en_US%26cmd=displayKC%26externalId=1015180.
75. What files make up a virtual machine? http://www.vmware.com/support/ws55/doc/ws_learningfiles_in_a_vm.html.
76. Understanding virtual machine snapshots in VMware ESX. http://kb.vmware.com/selfservice/microsites/search.do%3Flanguage=en_US%26cmd=displayKC%26externalId=1015180.
77. http://www.virtualizationdaily.com/archives/73_how-to-convert-a-vmware-virtual-appliance-to-work-with-parallels.html.
78. http://vmtoolkit.com/.
79. http://viethak.com/2009/11/27/Convert-VMDK-to-VHD-Virtual-Disk-or-Vice-versa-Using-StarWind-Image-Converter.html.
80. Barrett A. VMware makes the case for PCI DSS compliance Retrieved from http://searchservervirtualization.techtarget.com/news/article/0,289142,sid94_gci1338681,00.html. Accessed 12.11.08. http://SearchServerVirtualization.com.
81. Bem D., Huebner E. Computer forensic analysis in a virtual environment. International Journal of Digital Evidence 2007, Fall, 6(2). http://www.ijde.org.
82. Fegreus J. Automating D2D backup of virtual machines. InfoStor 2009, Retrevied from, Accessed 01.10.09. http://www.infostor.com/index/articles/display/articles/infostor/backup-and_recovery/disk-based-backup/lab-review__automating.html.
83. Hau W., Araujo R., Chudgar V., Hustad R., Chaubal C. How virtualization affects PCI DSS Part 1: Mapping PCI requirements and virtualization. VMware 2009, Retrieved from. http://www.vmware.com/files/pdf/technology/mapping_pci_req_part1_wp.pdf.
84. Hau W., Araujo R., Chudgar V., Hustad R., Chaubal C. How virtualization affects PCI DSS Part 2: a review of the top five issues. VMware 2010, Retrieved from. http://www.vmware.com/files/pdf/technology/review_top5_issues_wp.pdf.
85. Kusnetzky D. Virtual machines you have to see them to manage them. Kusnetsky group 2007, Retrieved from. http://www.virtual-strategy.com/Dan-Kusnetzky/Virtual-Machines-You-Have-to-See-Them-to-Manage-Them.html.
86. Miller R. Virtual machines can be an e-discovery nightmare. Fierce Content Management 2008, Retrieved from. http://www.fiercecontentmanagement.com/story/virtual-machines-can-be-e-discovery-nightmare/2008-09-11.
87. Mortman D. How to find virtual machines for greater virtualization compliance. Information Security Magazine 2009, Retrieved from, Accessed 07.08.09. http://searchsecurity.techtarget.com/tip/0,289483,sid14_gci1359272,00.html.
88. Shread P. Virtual machines pose e-discovery risk, vendor says. EnterpriseStorageForum 2008, September 10, Retrieved from. http://www.enterprisestorageforum.com/article.php/3770706.
89. Distributed Management Task Force, Inc. DMTF Creates Open Standard for System Virtualization Management. http://www.dmtf.org/newsroom/pr/view?item_key=70d5d3ba78d39488626f838397a3d1e9812e5d40.
90. How Virtualization Affects EDD Collection (). http://Law.com.
91. VM Sprawl - prevention rather than cure., Accessed 17.05.09. http://www.techworld.com/virtualisation/news/index.cfm?newsID=115876&pagtype.
92. Data center virtualization: Four steps to compliance, Special to SearchCIOMidmarket.com,. Accessed 11.06.08. http://searchcompliance.techtarget.com/tip/0,289483,sid195_gci1340735_mem1,00.html.
93. Capelis D.J. Virtualization: Enough holes to work Vegas. Defcon 15, Las Vegas 2007, Retrieved from. http://www.dc414.org/download/confs/defcon15/Speakers/Capelis/dc-15-%20capelis.pdf.
94. Cargile A. Hypervisor security concerns. The Coffee Desk 2009, Retrieved from. http://thecoffeedesk.com/news/index.php/2009/12/01/hypervisor-security-concerns/.
95. Charette S. How not to detect virtualization 2009, Retrieved from. http://charette.no-ip.com:81/programming/2009-12-30_Virtualization/.
96. Virtual machine security guidelines (version 1). The Center for Internet Security 2007, Retrieved from. http://www.cisecurity.org/tools2/vm/CIS_VM_Benchmark_v1.0.pdf, J. Kirch (Ed.).
97. Ferrie P. Attacks on more virtual machine emulators. Symantic Advanced Threat Research 2007, Retrieved from. http://www.symantec.com/avcenter/reference/Virtual_Machine_Threats.pdf.
98. Hankeln video Retrieved from. http://sanbarrow.com/latest-videoesxi-exe.html.
99. King S.T., Chen P.M., Wang Y.-M., Verbowski C., Wang H.J., Lorch J.R. SubVirt: implementing malware with virtual machines Retrieved from. http://portal.acm.org/citation.cfm%3Fid=1130383.
100. Liston T., Skoudis E. On the cutting edge: Thwarting virtual machine. IntelGuardians 2006, Retrieved from. http://handlers.sans.org/tliston/ThwartingVMDetection_Liston_Skoudis.pdf.
101. Moulton S. Data recovery and information about solid state devices and NAND flash memory. Video posted to 2008, August, http://www.youtube.com/view_play_list%3Fp=C337FACBF12BDCE2.
102. Rutkowska J. Red Pill.. or how to detect VMM using (almost) one CPU instruction Retrieved from. http://invisiblethings.org/papers/redpill.html.
103. Siebert, E. (2010, January 7). How to steal a virtual machine and its data in 3 easy steps. SearchVMware.com. Retrieved from. http://searchvmware.techtarget.com/news/article/0,289142,sid179_gci1378347,00.html.
104. STIG Security Technical Implementation Guides Information Assurance Support Environment Retrieved from. http://iase.disa.mil/stigs/stig/index.html.
105. Vanover, R. (2010). Breaking down the vStorage Virtual Machine File System (VMFS). SearchVMware.com. Retrieved from. http://searchvmware.techtarget.com/tip/0,289483,sid179_gci1368383_mem1,00.html.
106. VMware Virtualization: architectural considerations and other evaluation criteria http://www.vmware.com/pdf/virtualization_considerations.pdf.
107. Some space missing from a new VMFS data store due to hidden files VMware knowledge base. http://kb.vmware.com/selfservice/microsites/search.do%3Flanguage=en_US%26cmd=displayKC%26externalId=1001618.
108. Install and Configure ESX server. http://virtualizationinformation.com/docs/Notes%20on%20VI%203.pdf.
109. Defragmenting virtual machine files. http://itknowledgeexchange.techtarget.com/virtualization-pro/defragmenting-virtual-machine-disk-files/.
110. VMware, Randell. August 2008 presentation to the Arizona Security Practitioners Forum (AZSPF).
111. Xen Wiki Hypercall formal definition.
112. Haletky E. VMware vSphere and Virtual Infrastructure Security 2009, Prentice Hall.
113. Network segmentation in virtualized environments. VMware white paper. http://www.vmware.com/files/pdf/network_segmentation.pdf.
114. InfoClipz: Cloud Computing. April 2009. http://InfoWorld.com.
115. Beckman M. Cloud computing deep dive. InfoWorld 2009, September.
116. Amoah S. Cloud computing and network forensics in the eyes of computer forensic examiner. Decision Group 02/2010.
117. Navetta D. Legal implications of cloud computing http://LLRX.com.
118. Security guidance for critical areas of focus in cloud computing. Cloud Security Alliance December 2009.
119. Coates J., Jarrat J. What futurists believe 1989, Lomond Publication, Inc., Mt. Airy, MD.
120. Stokes J. The future of virtualization: a view from the front lines. ars technica 2009, May 6, Retrieved from. http://arstechnica.com/business/news/2009/05/the-future-of-virtualization-a-view-from-the-front-lines.ars.
121. Kharif O. Virtualization goes mobile. BusinessWeek Online 2008, April 9, Retrieved from. http://www.businessweek.com/technology/content/apr2008/tc20080421_235517.htm?chan=technology_technology%2Bindex%2Bpage_top%2Bst.
122. VMWare Mobile Virtualization Platform, (n.d.). Retrieved from. http://www.vmware.com/products/mobile/.
123. Tozzi J. The rise of the Homepreneur Retrieved from. http://www.businessweek.com/smallbiz/content/oct2009/sb20091023_263258.htm.
124. Mobile phone virtualization to really enable workers and IT staff. NetworkWorldAsia 2009, September 4, NetworkWorld Asia Staff, Retrieved from. http://www.networksasia.net/content/mobile-phone-virtualization-really-enable-workers-and-it-staff.
125. Goldman D. Tablet wars: Google looks to take on Apple iPad Retrieved from. http://money.cnn.com/2010/02/04/technology/apple_ipad_google_chrome/index.htm.
126. Mark R. House Passes Cyber-Security Act Retrieved from. http://www.eweek.com/c/a/Government-IT/House-Passes-Cybersecurity-Act-682741/.
127. Shankland S. Gartner: Brace yourself for cloud computing. CNET news 2009, October 20, Retrieved from. http://news.cnet.com/8301-30685_3-10378782-264.html.
128. An architectural blueprint for autonomic computing IBM, Retrieved from. http://www-03.ibm.com/autonomic/pdfs/AC%20Blueprint%20White%20Paper%20V7.pdf.
129. Horn P. How autonomic computing will reshape IT. CNET news 2001, October 15, Retrieved from. http://news.cnet.com/2010-1071-281578.html.