1. Mastering Windows Network Forensics and Investigation Chapter 17: The Challenges of Cloud Computing and Virtualization

2. Chapter Topics: Understand investigative implications when virtualization or cloud services are used Detect and acquire artifacts of virtualization applications Detect and acquire pertinent data from cloud services

3. What is Virtualization? Host-based –An environment that exists in specialized software within the host system designed to emulate a wholly separate OS with its own resources

4. What is Virtualization? Server-based –Environment is installed on top of the host hardware layer to maximizes system resources Hypervisor –makes virtualization possible Type 1 – bare metal Type 2 – hosted

5. What is Virtualization? Type 1 Type 2

6. Incident Response What is the scope of the network How is the environment configured? What machines have been compromised? What are their roles? Where are they?

7. Acquiring RAM Live Host-based Virtual Environment –Similar procedure as host system Methods –FTK Imager Lite –DumpIt –Force VM snapshot

8. Forensic Analysis Techniques Identify the source of digital evidence Forensically acquire the digital evidence Analyze digital evidence Report on pertinent findings

9. Dead Host-Based VM Locate files used to build virtual environment Acquire virtual disk (.vmdk) using forensic tools –FTK Imager

10. Dead Host-Based VM Analyze *.vmsd file –Contains meta data about specific VM’s saved to the host system Acquire memory –Locate *.vmem file –Structured the same as RAM from live system

11. Live Virtual Environment Structured the same as a traditional computer system Acquire logical or physical image of storage media using forensic tools –FTK Imager –EnCase Additional Artifacts –*vmem (virtual memory) –VM Snapshots

12. Cloud Computing What is it? –“a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources…”, NIST –Not new! Email Mainframe Dummy Terminals Services –IaaS Rackspace, VMWare vSphere –SaaS Google Apps, Dropbox, iCloud –PaaS AWS, SunCloud

13. Forensic Challenges Where is the evidence? –Client Level? –Cloud Service Level? –Underlying cloud servel level? –All of the above? Legal Authority –Jurisdictional obstacles –Who will you serve search warrant to? Where?