6533b858fe1ef96bd12b6371
RESEARCH PRODUCT
Hypervisor-assisted Atomic Memory Acquisition in Modern Systems
Roee LeonMichael KiperbergAsaf AlgawiNezer Jacob ZaidenbergAmit Reshsubject
integrity of a memory snapshotreliabilityvirtualisointiComputer scienceforensic soundnessHypervisormuistit (tietotekniikka)computer.software_genrevirtualizationatomicitymemory forensicsmemory acquisitionOperating systemMemory acquisitionlive forensicstietoturvacomputerdescription
Reliable memory acquisition is essential to forensic analysis of a cyber-crime. Various methods of memory acquisition have been proposed, ranging from tools based on a dedicated hardware to software only solutions. Recently, a hypervisor-based method for memory acquisition was proposed (Qi et al., 2017; Martignoni et al., 2010). This method obtains a reliable (atomic) memory image of a running system. The method achieves this by making all memory pages non-writable until they are copied to the memory image, thus preventing uncontrolled modification of these pages. Unfortunately, the proposed method has two deficiencies: (1) the method does not support multiprocessing and (2) the method does not support modern operating systems featuring address space layout randomization (ASLR). We describe a hypervisor-based memory acquisition method that solves the two aforementioned deficiencies. We analyze the memory usage and performance of the proposed method. peerReviewed
| year | journal | country | edition | language |
|---|---|---|---|---|
| 2019-01-01 | Proceedings of the 5th International Conference on Information Systems Security and Privacy |