WaybackVisor: Hypervisor-Based Scalable Live Forensic Architecture for Timeline Analysis

Current forensic investigations have to process a large amount of collected data in a limited time. Moreover, we need to ensure collected data are not compromised before seizing suspects’ computers. For protecting evidences on important computers, this paper proposes a lightweight hypervisor that supports proactive collection and preservation of I/O logs. The proposed WaybackVisor automatically transfers all I/O logs of ATA drives to a Hadoop cluster. Our experiment showed the prototype implementation of WaybackVisor achieves write throughput of 79.7 MB/s. This paper also demonstrates timeline analysis functions for the I/O logs on the Hadoop cluster. Finally, we compared the proposed WaybackVisor with similar lightweight hypervisors that support live forensics.