Modular computer forensic system and method based on hardware virtualization

Abstract

The invention discloses a modular computer forensic system and method based on hardware virtualization. The modular computer forensic system comprises an initialization drive, a system control center, a system support module set and a forensic function module set. The method is based on the hardware virtualization technology, a light virtual machine is set up through the initialization drive when an operation system operates, the system control center supports a hardware virtual platform and manages all sub modules, and the system support module set supports all basic functions of the forensic module set. According to the method, interfaces of the forensic function module set are standardized, multiplexing and extension of the modules are supported, and forensic tools can focus on the core function, and a large amount of repetitive work is reduced; no codes of the target operation system need to be modified, performance losses are low, memory usage is less, a safe and credible real-time forensic foundation platform is set up, and convenience is brought to acquisition of the various forensic tools based on virtualization.

Description

technical field [0001] The invention relates to a method in the field of computer forensics, in particular to a computer modular real-time forensics system and method based on hardware virtualization. Background technique [0002] The purpose of computer forensics is to provide the traces left by the criminals on the computer as effective evidence to the court to combat computer and network crimes. One of the difficult issues is how to obtain evidence of intrusion in the first time and find the criminal program or perpetrator in the event of computer intrusion. The current method of forensics is mainly based on the method of obtaining first and then analyzing, that is, first obtaining the memory image, and then reconstructing the intrusion event from the image information to try to obtain evidence. One of the disadvantages of this method is that memory acquisition requires a lot of time and space. To ensure the consistency of memory snapshots, it is necessary to stop the op...

AI Technical Summary

Problems solved by technology

One of the disadvantages of this method is that memory acquisition requires a lot of time and space. In order to ensure the consistency of memory snapshots, it is necessary to stop the operation of the target machine, that is, a long downtime will affect the normal operation of important machines.

It is also very complicated to process a complete memory image in the analysis phase

In addition, due to the volatility of memory, it is impossible to ensure that the image contains intrusion evidence, and the time-consuming nature of image acquisition and analysis makes it difficult to implement frequent image-based evidence acquisition methods.

Based on the above reasons, most of the current intrusions that occur in the kernel cannot be reconstructed

Images