Cloud Digital Investigations based on a Virtual Machine Computer History Model

In several traditional digital investigations, several forensic frameworks have been proposed. The selection of a suitable forensic framework for the cloud computing virtual environments further challenges the existing digital forensics space , as no conclusive generic framework exist that inclusively supports or can work for any Cloud Computing digital investigation. To solve this problem for the data cloud logical domains, this paper describes a model of using the computer’s virtual machine history based on finite state machine (FSM) automata theory. The model can be used to define the theory of a Virtual Machine (VM) Cloud Computing digital investigation allowing one to set the stage for prescribed applications operating within these abstract domains. The paper summarizes the theoretical concept used by the virtual machine hypervisor kernel logs that map the ideal and inferred VM history to the set of corresponding low level primitive states and events of the VM hosted computer environment.