An Ontology for Digital Forensics in IT Security Incidents - OPUS

Chapter 8
Evaluation
This chapter shows the eectiveness and eciency of the developed procedure
by applying it to four cases. The cases consist of real malware samples that
are run on a test system and analysed later.
8.1 Procedure
A VirtualBox[Oracle, 2012] virtual machine with Windows XP SP3 was
installed and a snapshot was taken at the rst start. The virtual machine
has 10 GB hard disk space and 256 MB random access memory. VirtualBox
is started with --dbg --startvm parameters to be able to use
the debug console.
For each malware sample the following steps were taken:
1. At rst the malware was inserted with a virtual CD, started and allowed
to run for a while. Depending on the malware, the system was
restarted to nd traces that make the malware run at every start of
the operating system.
2. Next the system was paused.
3. To extract the hard disk, the command
VBoxManage clonehd --format RAW
was used from a command line.
4. To extract the random access memory, the command
. pgmphystofile
was executed in the debug console that can be started by the
Command line... button in the Debug menu.
5. For the next step, the developed program was started to extract the
information from the snapshots and put it into the database. As explained
in section 7.8, this step took around two hours.
65