Virtual Infrastructure Forensics

Section 1
Digital Forensics - the What, Where, When, How and Why

Section 2
Virtual Infrastructure

Vendor-neutral VI ArchitecturePrincipals

• Hypervisors
• Virtual Machines
• Virtual Networks
• Virtual Disks
• Virtual File Systems
• Migration of Virtual Components

Vendor-specific VI Architecture

• vSphere - ESX 4.x, ESXi 4.x, vCenter 4.x,
• Hyper-V
• XenServer

Key Differences Between Physical and Virtual Infrastructures

Section 3
Forensic Investigation Process

Physical Infrastructure Best Practices

• Practices Equally Applicable Within Virtual Infrastructures

Virtual Infrastructure Best Practices

• Practices Unique To Virtual Infrastructures

Section 4
VI Forensics Scenario 1: Identifying direct evidence of a crime

Section 5
VI Forensics Scenario 2: Attributing evidence to specific suspects

Section 6
VI Forensics Scenario 3: Confirming (or negating) suspect alibis

Section 7
VI Forensics Scenario 4: Confirming (or negating) suspect statements

Section 8
VI Forensics Scenario 5: Determining (or negating) suspect intent

Section 9
VI Forensics Scenario 6: Identifying sources

Section 10
VI Forensics Scenario 7: Authenticating documents

Section 11
Putting it all together – course summary