Locating and Extracting Digital Evidence from Hosted Virtual Desktop Infrastructures: Cloud Context
Total Page:16
File Type:pdf, Size:1020Kb
Locating and Extracting Digital Evidence from Hosted virtual desktop Infrastructures: Cloud Context NIRBHAY JAWALE B.C.I.S (AUT University) New Zealand A thesis submitted to the graduate faculty of Design and Creative Technologies AUT University in partial fulfilment of the Requirements for the degree of Master of Forensic Information Technology School of Computing and Mathematical Sciences Auckland, New Zealand 2010 II Declaration I hereby declare that this submission is my own work and that, to the best of my knowledge and belief, it contains no material previously published or written by another person nor material which to a substantial extent has been accepted for the qualification of any other degree or diploma of a University or other institution of higher learning, except where due acknowledgement is made in the acknowledgements. ........................... Signature III Acknowledgements This thesis was conducted at the Faculty of Design and Creative Technologies in the school of Computing and Mathematical Sciences at AUT University, New Zealand. During the course of writing this thesis, I have received a valuable support from many people. Firstly, I would like to thank my family for their blessings, encouragement and believing that I could get through this study. Secondly, I am deeply thankful and honored by having Professor Ajit Narayanan as my thesis supervisor. This thesis would not have been possible without his guidance, encouragement and interest; he took to supervise my thesis topic. I very much enjoyed the critical discussions and comments on my research topic with Professor Ajit Narayanan, this thesis would not have been in the present form without his valuable contribution. I would also like to thank Dr Brian Cusack for his ongoing support during the course of Masters in Forensic IT. He has been extremely helpful during my PG1 approval, without his input this research topic would not have been approved in the first place. Lastly, I would like to thank everyone once again from the bottom of my heart for their support, encouragement and enthusiasm that has kept me going throughout this period. I also greatly appreciate all the MFIT staff and lecturers for sharing their knowledge and concepts; this has deepened my knowledge at a critical point of my life. IV Abstract The development of virtualization started in 1960, when VMware introduced partitioning of large mainframes for better hardware utilization. (Virtualization History, 2010) Since then virtualization has matured and been adopted to a wide extent in the industry. Recent developments include branching into areas of server virtualization, storage and application virtualization and, very recently, desktop virtualization. Desktop virtualization has so far been through two models: the Client hosted model, which is typically operated from the user’s workstation using Windows Virtual PC; and the VMware workstation or Java Virtual Machine (VM). However, recently a third model has emerged, called the server hosted model or Hosted virtual desktop (HVD), which is a virtualized form of desktop (VM) delivered to users from the cloud infrastructure. In other words virtualization in computing has progressed to an extent where desktops can be virtualized and accessed from anywhere. The server hosted model has already surpassed 1% market share of the worldwide professional PC market, with estimates indicating that this is a rapidly growing area. This study investigates the adequacy of current digital forensic procedures on hosted virtual desktops (HVDs) as there does not appear to be specific methods of locating and extracting evidences from this infrastructure. Using the Forensic Iterative Development Model (FIDM), HVDs deployed in private cloud were simulated to reflect three different computer crime (quasi- experimental) scenarios. It was found that current digital forensic procedures may not be adequate for locating and extracting evidence, since the infrastructure in scenario 2 and 3 introduces complications such as non-persistent disk modes and segregating data in a multi- tenant environment. However in scenario 1, findings illustrate that all standard investigation techniques can be followed as a result of the persistent user environment. Furthermore, suggestions are made to extend the current research in the areas of techniques to acquire virtual machines from hypervisors, hashing evidence and forensic readiness in environments consisting HVDs. V Table of Contents Declaration ...................................................................................................................................... ii Acknowledgements ........................................................................................................................ iii Abstract .......................................................................................................................................... iv List of Figures .............................................................................................................................. viii List of Tables ................................................................................................................................. ix List of Abbreviations ...................................................................................................................... x Chapter 1 - Introduction 1.0 INTRODUCTION ............................................................................................................... 1 1.1 PROBLEM DEFINITION ................................................................................................... 2 1.2 MOTIVATION .................................................................................................................... 3 1.2.1 Hosted virtual desktops and Forensics ......................................................................... 3 1.2.2 Forensic Challenges in Virtualized Environments ....................................................... 4 1.2.3 Thinking of What the Future Holds .............................................................................. 5 1.3 CONCLUSION - THESIS STRUCTURE .......................................................................... 5 Chapter 2 - Literature Review 2.0 INTRODUCTION ............................................................................................................... 8 2.1 THE CURRENT STATE OF DIGITAL FORENICS ......................................................... 8 2.1.1 Disciplines of Digital Forensics ................................................................................... 9 2.1.2 Investigation frameworks ........................................................................................... 11 2.1.3 Capability of Current Tools ........................................................................................ 14 2.1.3.1 Encase v7 ................................................................................................................ 14 2.1.3.2 Paraben and FTK .................................................................................................... 15 2.2 CURRENT STATE OF DESKTOP COMPUTING ......................................................... 15 2.2.1 Virtual Desktops ......................................................................................................... 17 2.3 CURRENT STATE OF DISTRIBUTED COMPUTING (CLOUD CONTEXT) ............ 19 2.3.1 Service Models ........................................................................................................... 20 2.3.2 Cloud Deployment Methods ....................................................................................... 21 2.3.3 Virtual Desktops in Clouds ........................................................................................ 23 2.3.4 Security and Forensic Challenges ............................................................................... 26 2.4 CURRENT FORENSIC CAPABILITIES ......................................................................... 28 2.4.1 Hiding in a Virtual World ........................................................................................... 29 2.4.2 Live Digital Forensics in the Virtual World ............................................................... 31 VI 2.4.3 Virtualization and Forensics ....................................................................................... 34 2.5 CONCLUSION .................................................................................................................. 38 Chapter 3 - Research Methodology 3.0 INTRODUCTION ............................................................................................................. 40 3.1 WHAT IS METHODOLOGY ........................................................................................... 41 3.2 RANGE OF METHODOLOGY'S..................................................................................... 42 3.2.1 Grounded Theory ........................................................................................................ 42 3.2.2 Descriptive Research Methodology............................................................................ 45 3.2.3 Case Study .................................................................................................................. 46 3.2.4 Scientific Methodology (SM) - Research ................................................................... 48 3.3 RESEARCH DESIGN ......................................................................................................