Virtual Forensics

Presented at Black Hat USA 2010, July 28, 2010, 11:15 a.m. (75 minutes)

This presentation will be about the problems we are facing when forensic research has to be done on environments which are virtualized. What are the differences between 'tradional' system forensics, what techniques & tools can be used. Which files are important when performing forensic research on Citrix & VMWare environments? What about VHD file format with Windows 7 and what do we need for future research?

Presenters:

• Christiaan Beek

Links:

• https://www.blackhat.com/html/bh-us-10/bh-us-10-archives.html#Beek
• https://media.blackhat.com/bh-us-10/presentations/Beek/BlackHat-USA-2010-Beek-Virtual-Forensics-slides.pdf

Similar Presentations:

• DerbyCon 3.0 All in the Family (2013) / An Anti-Forensics Primer
• DEF CON 18 (2010) / Sniper Forensics - One Shot, One Kill
• Black Hat USA 2016 / Memory Forensics Using Virtual Machine Introspection for Cloud Computing