A digital forensic model for introspection of virtual machines in cloud computing

Performing digital forensics in cloud can add a new dimension to the process of building trust in cloud. But the very characteristics of cloud such as lack of transparency, virtualization, legal issues etc., pose challenges to cloud forensics. Whether it is traditional digital forensics or cloud forensics, collecting comprehensive data for analysis is a major challenge in investigation. Data collection in highly virtualized environments like cloud is very complex. The ultimate goal of evidence collection and analysis is to prove to the court of law that they are forensically sound. We can use introspection techniques since these will not contaminate the state of the source of evidence while collecting the required data. We identified two major drawbacks in the introspection process. First, a proper triggering condition will only make the investigator to get the needed data. Failing to devise proper triggers will lead to loss of data in the cloud multi-tenant environment. Next, during the data collection the corresponding virtual machine (VM) has to be paused for a while, leading to performance degradation. In this paper, we emphasize mainly on the first issue and propose a framework for the introspection of virtual machines to address the same.