Andrew Frowen offers the following royalty-free article for you to publish online or in print. Feel free to use this article in your newsletter, website, ezine, blog, or forum. ----------- PUBLICATION GUIDELINES - You have permission to publish this article for free providing the "About the Author" box is included in its entirety. - Do not post/reprint this article in any site or publication that contains hate, violence, porn, warez, or supports illegal activity. - Do not use this article in violation of the US CAN-SPAM Act. If sent by email, this article must be delivered to opt-in subscribers only. - If you publish this article in a format that supports linking, please ensure that all URLs and email addresses are active links. - Please send a copy of the publication, or an email indicating the URL to [email protected] - Article Marketer (www.ArticleMarketer.com) has distributed this article on behalf of the author. Article Marketer does not own this article, please respect the author's copyright and publication guidelines. If you do not agree to these terms, please do not use this article. ----------- Article Title: Virtualisation Software In Computer Forensic Investigations Author: Andrew Frowen Category: Security, Information Technology Word Count: 551 Keywords: computer forensics, virtualisation software, computer crime, removable media Author's Email Address: [email protected] Article Source: http://www.articlemarketer.com ------------------ ARTICLE START ------------------
Virtualisation software allows a complete operating system to run from within another. So for example, a user might have a computer running Windows Vista, but by installing virtualisation software, they could run a copy of Windows XP from the desktop. This virtual operating system can then perform every action a 'real' virtual operating system can, including browsing the internet, editing files and accessing the CD ROM drive or other portable media. Such functionality might seem useless to some, but for many users it has a number of applications. For example, because virtualisation software can be stored on portable media such as a USB storage device, it allows the user to effectively take an entire user environment with them wherever they go. So rather than just carrying files, they can access all of their preferences on any machine. Alternatively, the same user may wish to access a piece of software that only works on the XP version of Windows. By installing virtualisation software, they could access this without having to revert the whole machine back to an older operating system. Where it is suspected that a computer has been used in the commission of a crime, however, these same benefits can become barriers to a successful investigation. Upon arrest of a suspect, computer equipment is typically confiscated and passed to a computer forensic expert for analysis. Such experts then aim to extract legally admissible evidence in the form of deleted files, registry entries and internet browsing histories. However, where a virtual machine has been used, the browsing history and registry data is written to the virtual machine and not to the host computer. This means that if the portable storage device is removed, there will be little or no evidence of user activity on the host machine. Most virtual machines require the user to install software on to the host, so there may at least be registry evidence that the software itself was once present, but some can be accessed directly from a CD ROM or USB storage device, in which case even less of a trace would be left. For this reason, computer forensic analysts typically check the registry for signs that removable media has been connected. In some cases, computer forensic experts may be able to extract information about activity on a virtual machine by analysing the communications between the portable device and its driver, stored on the host machine. The common use of portable media to store virtualisation software makes it all the more important that such devices are located and analysed in any computer forensic investigation. Yet even if the virtualisation software is located, a core problem for computer forensic analysts is posed where the user does not save the environment in its new state before exiting. Essentially, this means that records of activity will be permanently deleted in a way that makes them impossible to recover. At present, the use of virtualisation software in the home is relatively uncommon, and server side monitoring of those accessing indecent images of children or other such illegal material is still effective in capturing perpetrators, even where virtualisation software is in use. Nevertheless, the recovery of computer based evidence remains vital, so computer forensics is now moving into the virtual world, finding new ways to extract data from ever more elusive virtual machines. IntaForensics a BS EN ISO 9001:2000 registered firm providing Computer Forensics, Expert Witness, Mobile Phone Forensics, and Forensic Data Recovery to the Legal Sector, Police Forces, Local Authorities and Commercial organisations internationally. Visit http://www.intaforensics.com. ------------------ ARTICLE END ------------------ [Non-text portions of this message have been removed]
