Forensic VM Snapshotting for Evidence Preservation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems lack efficient methods to preserve and restore the state of virtual machines for forensic investigation and efficient resumption from suspension, as frequent restarts and re-instantiations can eliminate evidence of attacks and system issues.
Innovation Solution
A system and method for capturing and storing snapshots of virtual machines, including initial and current states, to recreate the system state for forensic analysis and efficient resumption, by isolating machines, determining differences, and storing only local changes, allowing for precise restoration and quick resumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual computing instances are frequently restarted and re-instantiated from known-good software images, then security and system reliability are improved, but evidence of attacks and system issues is eliminated
Solution Approach 1:
The system performs preliminary actions by capturing snapshots of the virtual machine state before termination. This allows preservation of evidence (logs, memory state, file system) while still enabling future restarts from clean images, thus maintaining both reliability and evidence preservation capabilities
Solution Approach 2:
The system creates a copy (snapshot) of the virtual machine's state at the time of termination. This snapshot contains all evidence and system state information, allowing forensic analysis without requiring the actual terminated VM to remain running or be accessible after restart
2Difficulty of detecting and measuring
If full snapshots of virtual machine states are captured and stored, then forensic investigation capability is improved, but storage requirements increase
Solution Approach 1:
The system extracts only the essential forensic evidence from the complete virtual machine state. Instead of storing entire disk images, it captures and stores only critical components (memory state, process information, system logs, configuration data) that are necessary for forensic analysis, significantly reducing storage requirements
Solution Approach 2:
The snapshot is segmented into multiple components (memory snapshot, file system state, process information, log data). This allows selective storage and retrieval of only the necessary segments for forensic investigation, optimizing both storage efficiency and investigative capability
3Loss of information
If virtual machines are isolated and snapshots are captured before termination, then evidence integrity is maintained, but system availability decreases
Solution Approach 1:
The system performs the snapshot capture operation before initiating termination, ensuring evidence is preserved while allowing the termination process to proceed efficiently. This preliminary action minimizes the time the system is in a transitional state, reducing impact on availability
Solution Approach 2:
By creating a copy of the virtual machine state, the system allows the original VM to be terminated and restarted without affecting the integrity of the captured evidence. The copy can be stored and analyzed independently, maintaining evidence integrity while enabling rapid system recovery and minimal disruption to service availability
Data Source
AI summary
A system and method for capturing forensic snapshots of virtual machines prior to terminating the virtual machine, the system and method including obtaining a configuration that specifies an event and running a virtual machine in accordance with the configuration. Upon detection of an occurrence of the specified event, the system and method further includes determining a state of the virtual machine, storing information based at least in part on the determined state of the virtual machine, the information usable at least in part to recreate the state of the virtual machine, terminating the virtual machine, and running another virtual machine in accordance with the configuration.