Server Virtualization Acquisition Using Live Forensics Method

Abstract

Server virtualization is a technology that can run multiple operating systems simultaneously on one computer. The emergence of server virtualization invites a new crime gap that is different from the challenge of finding clues and digital evidence in uncovering cases of crime. This certainly makes it difficult for investigators to make acquisitions of one of the operating systems in server virtualization without disturbing and shutting down the computer given the importance of the server. So far, acquisition techniques are generally used singly which only contains one operating system. Therefore, it is necessary to have a technique to acquire server virtualization by using the live forensics method without interrupting or shutting down other running operating systems. The use of the live forensics method to acquire server virtualization is done by applying three acquisition techniques. Three acquisition technique models are carried out by acquiring one of the operating systems that are in the virtual machine on server virtualization through the Proxmox server without turning off the other operating systems that are running. Of the three acquisition models that have been tested, it is known that there are two models of acquisition techniques that are well used and recommended based on the situation and conditions that are occurring.

Perbandingan Tools Forensics pada Fitur TRIM SSD NVMe Menggunakan Metode Live Forensics

“…Bukti digital yang dibutuhkan dapat diperoleh dengan menggunakan teknik live forensics. Live forensics adalah sebuah metode yang digunakan untuk penanganan kejahatan komputer dan data recovery saat sistem komputer sedang berjalan [13]. Teknik live forensics mampu meningkatkan hasil data recovery bukti digital dari fungsi TRIM di SSD NVMe.…”

“…Metode live forensics bertujuan agar penanganan investigasi lebih cepat, integritas data lebih terjamin, teknik enkripsi lebih memungkinkan untuk dibaca dan meminimalkan kapasitas imaging memori bila dibandingkan dengan teknik forensik tradisional [21,22]. Menurut penelitian yang dilakukan oleh Soni dkk [13], metode live forensics diterapkan untuk melakukan data recovery pada saat virtual server sedang berjalan. Proses live forensics virtual server dilakukan seperti menggunakan virtual mesin proxmox yang menyediakan fitur backup.…”

Live forensics method for acquisition on the Solid State Drive (SSD) NVMe TRIM function

“…The required digital evidence can be obtained using live forensics technique. Live forensics is a method used for handling computer crime and data recovery while the computer system is running [13]. Live forensics technique will be able to improve the results of digital evidence data recovery from the TRIM function on the NVMe SSD.…”

“…The advantages of live forensics method include faster investigation process, secure data integrity, more readable encryption technique and less memory imaging capacity compared to traditional forensic techniques [21][22]. In a research conducted by Soni et al [13], live forensics method was applied to perform data recovery while the virtual server was running. The live forensics virtual server process was carried out by using a proxmox virtual machine that provided backup features.…”

Live Forensics Method for Acquisition on the Solid State Drive (SSD) NVMe TRIM Function

“…The advantages of live forensics method include faster investigation process, secure data integrity, more readable encryption technique and less memory imaging capacity compared to traditional forensic techniques [21] [22]. In a research conducted by Soni et al [13], live forensics method was applied to perform data recovery while the virtual server was running. The live forensics virtual server process was carried out by using a proxmox virtual machine that provided backup features.…”