Memory Forensics using Virtual Machine Introspection for Cloud Computing

Recommendations

Info

Hardware virtualization One / Multiple guest OS on virtualized hardware Managed by <strong>Virtual</strong> <strong>Machine</strong> Monitor (VMM) – Hypervisor Provides interfaces and controls interactions with hardware • CPU, memory, network, storage,… Hypervisor on own OS – Host OS
Native vs. hosted virtualization Application Application Application Guest OS Application Application Application Guest OS Application Application Guest OS Application Application Application Guest OS Hypervisor Application Application Application Hypervisor Hardware Native virtualization Host OS Hardware Hosted virtualization
Page 1 and 2: Memory Forensics using Virtual Mach
Page 3 and 4: What is it about? And why do we nee
Page 5 and 6: Motivation Relocation of systems an
Page 7: Forensic Process Collection Examina
Page 11 and 12: Semantic gap Difference between the
Page 13 and 14: Advantages No altering of the targe
Page 15 and 16: Fields of application Examples Root
Page 17 and 18: Solution approach Combining existin
Page 19 and 20: VM1 VM2 Dom U Dom U Dom 0 Hyperviso
Page 21 and 22: Open nebula extensions www.opennebu
Page 23 and 24: Forensic Process Collection Examina
Page 25 and 26: Forensic Process • OS on Cloud No
Page 27 and 28: Forensic Process • Completely on
Page 29 and 30: Disadvantages Configuration necessa
Page 31 and 32: Volatility / Libvmi usage
Page 33 and 34: Use case Enduser VM in Iaas cloud
Page 35 and 36: Summary
Page 37 and 38: Black hat sound bytes Hypervisor fo
Page 39: Contact Tobias Zillner tobias@zilln

Memory Forensics using Virtual Machine Introspection for Cloud Computing

Create successful ePaper yourself

Delete template?

Save as template?