2. Motivation 2 Static Acquisition Live Acquisition Static AcquisitionLive Acquisition In-Disk Evidence In-Memory Evidence 24/7 Availability Servers

3. Problem - Live Acquisition 3 Live Acquisition Target System requiring in VM Already Low Result Accuracy Virtualization Introspection In-OS Introspection

4. Late Virtualization 4

5. 5 Hardware OS Kernel User App Vis Hypervisor Virtual Machine Event Handler Vis Driver Event

6. Virtual Snapshot 6 Dump! Time Finish! Guest Virtual Pages Unmodified Modified Acquisition Duration (>10 Seconds) Guest Physical Pages Machine Physical Pages Legend

7. Virtual Snapshot 7 Dump! Time Finish! Guest Virtual Pages Unmodified Modified Acquisition Duration (>10 Seconds) Guest Physical Pages Machine Physical Pages Legend

8. Virtual Snapshot 8 Dump! Time Finish! Guest Virtual Pages Unmodified Modified Acquisition Duration (>10 Seconds) Guest Physical Pages Machine Physical Pages Legend Dumping

9. Implementation Based on Techniques: – Intel® VT-x – EPT for Nested Paging Vis Prototype – Support Windows 7 i386 (Uniprocessor) – Tailored from NewBluePill (Hypervisor based virus) 9

10. Effectiveness Evaluation 10

11. Performance Evaluation 11 Normalized Performance Benchmarks

12. Performance Evaluation 12 Normalized Performance

13. Discussions Trustworthy hypervisor – Hypervisor code can be attested before being loaded via Trusted Platform Module (TPM) (Martignoni et al, RAID’10) No nested virtualization – The Turtles Project (Muli et al, OSDI’10) – For future work A little invasion is acceptable – Locard’s exchange principle (Chisum, Journal of Behavioral Profiling, January 2000) 13

14. Summary Vis achieved: – Virtualization for native system – Accurate acquisition 14 Vis Virtualization for Native System Accurate Acquisition

16. Backup 16