ESXI虚拟化环境取证分析  

Forensic analysis of ESXI virtualized environments

作　　者：支中强 展福利 ZHI Zhongqiang;ZHAN Fuli(Hangzhou Public Security Bureau Internet Police Branch,Hangzhou 311000,China)

机构地区：[1]杭州市公安局网络警察分局,浙江杭州311000

出　　处：《中国高新科技》2024年第18期53-55,共3页

摘　　要：在新的电子取证时代,各种数据组织、存储、处理、传输等新技术和应用,例如VMware vSphere ESXI虚拟化技术,在因特网上得到了广泛的应用,使得以往以单机为主传统电子证据模式面临着空前的挑战。如何在分散存储的环境下,迅速地获取所需的电子证据,一直是取证技术人员面临的一个问题。基于国内外的相关研究,为满足从虚拟化的特点、虚拟化环境下的取证策略等方面进行了全面探讨。In the new era of digital forensics,various technologies and applications for data organization,storage,processing,and transmission,such as VMware vSphere ESXI virtualization technology,have been widely implemented on the internet.This“virtualization technology”poses unprecedented challenges to the traditional model of digital evidence collection,which primarily focused on individual machines.One of the persistent challenges for forensic experts is the rapid acquisition of necessary digital evidence in a decentralized storage environment.Based on relevant domestic and international research,this paper provides a comprehensive discussion on the characteristics of virtualization and forensic strategies in virtualized environments.

关 键 词：ESXI 虚拟化 电子取证 

分 类 号：TP302[自动化与计算机技术—计算机系统结构]