Virtualization and Forensics: A Digital Forensic Investigator's Guide to Virtual Environments

Virtualized environments can make forensics investigation more difficult. Technological advances in virtualization tools essentially make removable media a PC that can be carried around in a pocket or around a neck. Running operating systems and applications this way leaves very little trace on the host system. Virtualization and Forensics explores all the newest methods for virtualized environments and the implications they have on the world of forensics. The book begins by explaining the different types of virtualization, then how virtualization affects the basic forensic process. It describes common methods to find virtualization artifacts on dead drives, live analysis and identify virtual activities that affect the examination process of virtualized environments. Finally, it will address virtualization issues such as security, data retention policies, and where the world of virtualization is headed.