Download Digital Forensic Reconstruction

This paper presents ViSe, a virtual security testbed, and demonstrates how it can be used to efficiently study computer attacksand suspect tools as part of a computer crime reconstruction. Based on a hypothesis of the security incident in question, ViSe is configured with the appropriate operating systems, services, and exploits. The attack is formulated as an event chain and replayed on the testbed. The effects of each event are analyzed in order to support or refute the hypothesis. The purpose of the approach is to facilitate forensic testing of a digital crime using minimal resources.