Centro de Documentação da PJ
Analítico de Periódico
CD 341
In the time loop [Recurso eletrónico] : data remanence in main memory of virtual machines / Ella Savchenko, Jenny Ottmann, Felix Freiling
Forensic Science International: Digital Investigation, Vol. 49, supplement (July 2024), 9 p.
Ficheiro de 2,6 MB em formato PDF.
CRIPTOGRAFIA, BASE DE DADOS, COMPUTADOR , INFORMÁTICA FORENSE
Data remanence in the physical memory of computers, i.e., the fact that data remains temporarily in memory even after power is cut, is a well-known issue which can be exploited for recovering cryptographic keys and other data in forensic investigations. Since virtual machines in many aspects mimic their physical counterparts, we investigate whether data remanence is also observable in virtual machines. Using KVM as an example of virtualization technology, we experimentally show that it is common for a substantial amount of volatile data to remain in the memory of virtual machines after a reboot. In digital forensic analysis scenarios such as malware analysis using virtual machines, our observations imply high risks of evidence contamination if no precautions are taken. So while the symptoms of data remanence in virtual machines are similar to physical machines, the implications for digital forensic analysis appear very different.
