Virtual Forensics

Presented at Black Hat USA 2010, July 28, 2010, 11:15 a.m. (75 minutes).

This presentation will be about the problems we are facing when forensic research has to be done on environments which are virtualized. What are the differences between 'tradional' system forensics, what techniques & tools can be used. Which files are important when performing forensic research on Citrix & VMWare environments? What about VHD file format with Windows 7 and what do we need for future research?

Presenters:

• Christiaan Beek

Links:

• https://www.blackhat.com/html/bh-us-10/bh-us-10-archives.html#Beek
• https://media.blackhat.com/bh-us-10/presentations/Beek/BlackHat-USA-2010-Beek-Virtual-Forensics-slides.pdf

Similar Presentations:

• Black Hat USA 2016 / Memory Forensics Using Virtual Machine Introspection for Cloud Computing
• Black Hat USA 2013 / Malicious File for Exploiting Forensic Software
• DerbyCon 3.0 All in the Family (2013) / An Anti-Forensics Primer