Module 6 - Usefulness in Investigations - Virtualized Environments

Question 1

Benefit of Virtualization

Answer 1

can change a static, dead-box analysis to a live analysis, which can be more insightful.

Question 2

Types of Info / Collection on Virtualized System (4)

Answer 2

• This allows an examiner to see what a user saw
• Let malware continue to run identifying running processes
• Allow for the capture of memory, which is helpful after malware launches
• Allows for logs on the virtual system, e.g., anti-virus logs, to viewed with native applications

Question 3

From memory on live (virtualized) system, can determine: (4)

Answer 3

• open ports and processes
• Sockets
• Files loaded into memory
• Encryption keys

Question 4

Virtualization and malware analysis

Answer 4

• simulate Internet connection

- malware may be VM aware

Question 5

Snapshots

Answer 5

• can be used to rollback state of VM