Computer Forensic Analysis in a Virtual Environment

In this paper we discuss the potential role of virtual environments in the analysis phase of computer forensics investigations. General concepts of virtual environments and software tools are presented and discussed. Further we identify the limitations of virtual environments leading to the conclusion that this method can not be considered to be a replacement for conventional techniques of computer evidence collection and analysis. We propose a new approach where two environments, conventional and virtual, are used independently. Further we demonstrate that this approach can considerably shorten the time of the computer forensics investigation analysis phase and it also allows for better utilisation of less qualified personnel.

• Type: Journal
• Year: 2007
• Where: IJDE
• Authors: Derek Bem, Ewa Huebner
• Keywords: Computer Forensics Investigation, IJDE 2007, Potential Role, Virtual Environments