O'Reilly logo

Mastering Python Forensics by Dr. Johann Uhrmann, Dr. Michael Spreitzenbarth

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Using virtualization as a source of evidence

Virtualization is not just dangerous and challenging when it comes to forensic investigations, there is also the potential to use virtualization as a tool for gathering forensic evidence. In the following sections, you will see various sources which can lead to the evidence.

Creating forensic copies of RAM content

Normally, creating a copy of a system's RAM contents requires access to the target system, a logon, installing the required tools, and copying away the RAM dump to an external media. All of these steps are intrusive, that is, changing the state of the system and being subject to detection by the attacker or his malware. Furthermore, an attacker with administrative privileges may hide portions ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required