A Virtualization Based Monitoring System for Mini-intrusive Live Forensics

Abstract. Digital evidences hold great significance for governing cyber-crime. Unfortunately, previous acquisition tools were troubled by either the shortage of suspending the target system’s running or the securi-ty of the acquisition tools themselves, thus the correctness and accura-cy of their obtained evidences cannot be guaranteed. In this paper, we propose VAIL, a novel virtualization based monitoring system for mini-intrusive live forensics, which employs hardware assisted virtualization technique to gather integrated information from the native computer system. Meanwhile, the execution of the target system will not be inter-rupted and VAIL keeps immune to attacks from the target system. We have implemented a proof-of-concept prototype that has been validated with a Windows guest system. The experimental results show that VAIL can obtain comprehensive digital evidences from the target system as de-signed, including the CPU state, the physical memory content, and the I/O activities. And on average, VAIL only introduces 4.21 % performance overhead to the target system, which proves that VAIL is practical in real commercial environments.