Security

Digital Forensics in a Virtualized Environment

These 5 tips can help when examining virtual machines.

Gary Kessler is the president of Gary Kessler Associates, a member of the Vermont Internet Crimes Against Children (ICAC) Task Force, and adjunct associate professor at Edith Cowan University in Perth, Australia.

Someone once described virtualization as something you pay for but don’t actually get. Client virtualization offers a similar analogy: A virtual machine is software that runs on a computer and allows a single host to appear as if it were itself a computer.

It’s a technology that offers many benefits, but it also changes the nature of digital forensics investigations. VMs are increasingly the target or instrument of nefarious activity, but they are also used as the platform on which to perform examinations. The following tips can help digital forensics examiners (DFEs) familiarize themselves with virtualized client environments and their impact on computer forensics investigations.

1. Use the tool.

DFEs should implement a VM on their own computer so that they understand how it is used. For example, install VM software, such as Parallels Desktop for Mac, Microsoft VirtualPC or VMware Workstation, on the host computer. To add a guest operating system, start the VM application, configure a few parameters such as the amount of disk space and memory to allocate for the new VM, then install the guest OS. This also provides an inexpensive way to gain experience with other OSes.

2. Learn what kind of traces VMs leave behind.

One difficulty that VMs present to DFEs is that the guest environment is fully self-contained in a small set of files on the host system. The examiner has to find the VM files to recover the guest OS and its contents.

For example, VMware Fusion on a Mac stores the VM environment in a file with the extension .vmwarevm, while VMware on the PC uses a series of files with file extensions such as .vmdk, .nvram and .vmx. The VM files are often stored in directories with a name such as “Virtual Machines.”

The Windows Registry also maintains information that might be useful in finding VMs. Most Recently Used keys may provide pointers to VM application software, while File Associations keys will show the link between a VM application and relevant file extensions — sometimes, even if the application has been removed from the system. Finally, traces of VMs may be found in the process list within RAM.

3. Dust off your imaging skills.

Because the VM is an environment inside of the host system, there are different methods that need to be considered for forensically imaging the guest OS environment.

Start the guest OS in a forensically sound environment and perform a live image of the VM as you would a live image on any other computer.
Use imaging software that can open the guest OS from the VM files (for example, FTK Imager).
Employ an application, such as VMware Disk Mount, that can mount the VM as a physical drive, which can then be imaged.

Once imaged, the VM can be examined using the same tools and methods as a traditional system with that OS.

4. Use client virtualization to aid in the examination process.

There are some situations where it would be useful to actually boot up a suspect computer, an action that is counter to all digital forensics best practices. One solution is to boot the suspect system into a VM from the suspect computer’s image files. In this way, the examiner can see exactly what a user would see on the suspect computer without ever actually touching (or possibly altering) the suspect computer. LiveView is one such tool that can create a VMware virtual machine from raw (dd) image files.

5. Use virtualization in the examination environment.

Some computer forensics labs save a known, stable forensics environment as a VM and load a new VM for each new examination. In this way, all examinations start out in a forensically clean state, and a snapshot of the examination system is always available to this, or another, examiner.

Small Device, Big Threat

The challenge of tracing a mobile virtual operating environment is exacerbated by today’s high capacity, physically small media devices. A USB thumb drive with 1 gigabyte becomes the equivalent of a bootable CD-ROM, only a lot more convenient to carry.

Let’s say a user wants access to the Internet but must elude detection. That person could put a small footprint operating system on a thumb drive, walk into an Internet cafe, insert the thumb drive into a computer and reboot into the thumb drive’s OS. (Alternatively, a virtual machine with VM player software on a thumb drive could be used to mount a new OS without rebooting.)

The user could then do whatever he or she wanted to on the host computer, unplug the thumb drive when finished, reboot the computer (if necessary), and leave without a trace. Although it might be possible to track the activity back to the IP address of the physical computer, this scenario will leave no traces of the activity on the hard drive; few, if any, traces in the registry; and, upon rebooting, no trace in memory. This type of “visit” is therefore nearly impossible to investigate.