Safeguarding Forensic Integrity of Virtual Environment Evidence

Abstract

Virtual machine technology has emerged with powerful features, offering several benefits and promising revolutionary outcomes. It is one technology that combines into one package several computing concepts like resource management, emulation, time-sharing, isolation and partitioning. These features have made evidence acquisition and preservation difficult and in some cases unfeasible. The aftermath is that conventional approaches to integrity preservation have not yielded the best results required to facilitate acceptability. Subjects around virtualization forensics, its affiliation with digital evidence integrity, and impacts on admissibility have been decisively examined. A part of this discourse dwelt on recognising potential threats to the integrity and reliability of evidence from a virtual environment; specifically using VMware Virtual Machine Monitor as a case study. A theoretical framework for preserving the integrity of digital evidence from such environments is introduced. This structure highlights guidelines, processes and parameters essential for keeping the accuracy, consistency and trustworthiness of digital evidence, made possible via abstractions from eminent integrity principles of well-formed transactions and separation of duties as proposed by Clark and Wilson. Key parameters in the model include; strength of hash functions, number of evidence attributes, and number of evidence cycle covered; all represented conceptually in a mathematical model. This is further consolidated with the introduction of an integrity rating factor/threshold and the definition of an integrity enforcement process in line with globally recommended standards. While still working on practical demonstration of the proposed model, the work done so far is seen to open a path for unification and amplification of trust levels required for the admissibility of virtual environment evidence.

A cyber kill chain based taxonomy of banking Trojans for evolutionary computational intelligence

“…Attackers not only evade detection mechanisms but also they will try to make it difficult for forensics investigators to understand their intentions [69], [70]. Malwares can exploit systems in ways to make it difficult to be realised or investigated easily.…”

“…The idea here is intelligent gathering while protecting live environment, and ultimately paralysing the Trojan botnet. With the utilisation of virtual machines or cloud based simulation platforms security experts can gather sufficient evidence up to successful prosecution provided the integrity of the evidence is accounted for [6], [70]. With offensive strategies skiing on the edge of the line of legality and ethics, one needs to be very careful as attacking back is not only unethical but illegal too.…”