Title: Module 3 Introduction
Course: CAP 2141 Digital Forensics II > Section: Module 3 Virtual Machines, Network Forensics, and Live Acquisition

Introduction

If you are responsible for collecting and analyzing digital evidence, you are already aware of how platform and desktop virtualization are changing the way organizations, corporations, and government agencies deliver, store, and manage digital content. Virtualization adds an enormous level of complexity to an already complex field. As forensic practitioners tasked with performing examinations on enterprise virtual environments, they are confronted with the challenge of understanding what VM-related files are of significant importance.

Objectives

At the end of this module the student will be able to:

- Describe primary concerns in conducting forensic examinations of virtual machines
- Describe the importance of network forensics
- Explain standard procedures for performing a live acquisition
- Explain standard procedures for network forensics
- Describe the use of network tools

Readings and Resources

- Textbook: Chapter 11 pg. 423-445
- How to plan for a possible network attack: www.windowsecurity.com/articles/Plan-Possible-Network-Attack.html
- ARP poisoning: www.securitywarnings.com/encyclopedia/?id=12
- Smurf attack: www.cert.org/advisories/CA-1998-01.html
- IP spoofing: www.securityfocus.com/infocus/1674
- Session hijacking: www.iss.net/security_center/advice/Exploits/TCP/session_hijacking/default.htm