Motivation 2 Static Acquisition Live Acquisition Static AcquisitionLive Acquisition In-Disk Evidence In-Memory Evidence 24/7 Availability Servers

Problem - Live Acquisition 3 Live Acquisition Target System requiring in VM Already Low Result Accuracy Virtualization Introspection In-OS Introspection

Late Virtualization 4

5 Hardware OS Kernel User App Vis Hypervisor Virtual Machine Event Handler Vis Driver Event

Virtual Snapshot 6 Dump! Time Finish! Guest Virtual Pages Unmodified Modified Acquisition Duration (>10 Seconds) Guest Physical Pages Machine Physical Pages Legend

Virtual Snapshot 7 Dump! Time Finish! Guest Virtual Pages Unmodified Modified Acquisition Duration (>10 Seconds) Guest Physical Pages Machine Physical Pages Legend

Virtual Snapshot 8 Dump! Time Finish! Guest Virtual Pages Unmodified Modified Acquisition Duration (>10 Seconds) Guest Physical Pages Machine Physical Pages Legend Dumping

Implementation Based on Techniques: – Intel® VT-x – EPT for Nested Paging Vis Prototype – Support Windows 7 i386 (Uniprocessor) – Tailored from NewBluePill (Hypervisor based virus) 9

Effectiveness Evaluation 10

Performance Evaluation 11 Normalized Performance Benchmarks

Performance Evaluation 12 Normalized Performance

Discussions Trustworthy hypervisor – Hypervisor code can be attested before being loaded via Trusted Platform Module (TPM) (Martignoni et al, RAID’10) No nested virtualization – The Turtles Project (Muli et al, OSDI’10) – For future work A little invasion is acceptable – Locard’s exchange principle (Chisum, Journal of Behavioral Profiling, January 2000) 13

Summary Vis achieved: – Virtualization for native system – Accurate acquisition 14 Vis Virtualization for Native System Accurate Acquisition

Backup 16