http://it-forensik.fiw.hs-wismar.de/index.php?action=history&feed=atom&title=Ute_Sch%C3%BCller 2026-10-31T10:17:36Z Versionsgeschichte dieser Seite in IT-Forensik Wiki MediaWiki 1.43.11 http://it-forensik.fiw.hs-wismar.de/index.php?title=Ute_Sch%C3%BCller&diff=889&oldid=prev 2019-09-25T10:47:24Z

<p></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="de"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Nächstältere Version</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Version vom 25. September 2019, 10:47 Uhr</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l41">Zeile 41:</td> <td colspan="2" class="diff-lineno">Zeile 41:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Untersuchungen genutzt werden kann.</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Untersuchungen genutzt werden kann.</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>[[Media:<del style="font-weight: bold; text-decoration: none;">MT_Stemplewitz</del>.pdf|Download PDF-Dokument]]</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>[[Media:<ins style="font-weight: bold; text-decoration: none;">MT-Schueller</ins>.pdf|Download PDF-Dokument]]</div></td></tr> <!-- diff cache key it_forensik_wiki:diff:1.41:old-886:rev-889:php=table --> </table>

Etduen http://it-forensik.fiw.hs-wismar.de/index.php?title=Ute_Sch%C3%BCller&diff=886&oldid=prev 2019-09-25T07:56:31Z

<p></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="de"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Nächstältere Version</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Version vom 25. September 2019, 07:56 Uhr</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l1">Zeile 1:</td> <td colspan="2" class="diff-lineno">Zeile 1:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Master Thesis, Hochschule Wismar, September 2019</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Master Thesis, Hochschule Wismar, September 2019</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">Autor</del>: Ute Schüller</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">Author</ins>: Ute Schüller</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">Titel</del>: Capabilities of Live/Memory-Forensics on Compartmentalized Systems Using Bromium, Qubes and Proxmox as Examples</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">Title</ins>: Capabilities of Live/Memory-Forensics on Compartmentalized Systems Using Bromium, Qubes and Proxmox as Examples</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">Abstrakt</del>: With the constantly increasing digitalization of daily life, there is also a rising number of attacks,</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">Abstract</ins>: With the constantly increasing digitalization of daily life, there is also a rising number of attacks,</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>against private as well as company computers. One of the options to reduce those risks, is the</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>against private as well as company computers. One of the options to reduce those risks, is the</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>usage of operating systems or software, that provide compartments (aka. sandboxes or</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>usage of operating systems or software, that provide compartments (aka. sandboxes or</div></td></tr> <tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l20">Zeile 20:</td> <td colspan="2" class="diff-lineno">Zeile 20:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>implemented, for later IT-forensic investigation.</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>implemented, for later IT-forensic investigation.</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">In GERMAN</del>:</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">Autor</ins>: <ins style="font-weight: bold; text-decoration: none;">Ute Schüller </ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Titel: Möglichkeiten der Live/Memory-Forensik auf kompartimentierten Systeme am</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Titel: Möglichkeiten der Live/Memory-Forensik auf kompartimentierten Systeme am</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Beispiel von Bromium, Qubes und Proxmox</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Beispiel von Bromium, Qubes und Proxmox</div></td></tr> <!-- diff cache key it_forensik_wiki:diff:1.41:old-885:rev-886:php=table --> </table>

Etduen http://it-forensik.fiw.hs-wismar.de/index.php?title=Ute_Sch%C3%BCller&diff=885&oldid=prev 2019-09-25T07:55:52Z

<p>Die Seite wurde neu angelegt: „Master Thesis, Hochschule Wismar, September 2019 Autor: Ute Schüller Titel: Capabilities of Live/Memory-Forensics on Compartmentalized Systems Using Bromium…“</p> <p><b>Neue Seite</b></p><div>Master Thesis, Hochschule Wismar, September 2019<br /> <br /> Autor: Ute Schüller<br /> <br /> Titel: Capabilities of Live/Memory-Forensics on Compartmentalized Systems Using Bromium, Qubes and Proxmox as Examples<br /> <br /> Abstrakt: With the constantly increasing digitalization of daily life, there is also a rising number of attacks,<br /> against private as well as company computers. One of the options to reduce those risks, is the<br /> usage of operating systems or software, that provide compartments (aka. sandboxes or<br /> containers), when working on a network-connected computer. Despite the reduced risks,<br /> sometimes the need for live/memory-forensics arises on those systems, as well. How to perform<br /> such an analysis, is well-documented for e.g. VMware; nevertheless, for Bromium, Qubes and<br /> Proxmox, there is not much literature available. Consequently, the aim of this master thesis is to<br /> investigate the available options for those 3 operating systems. On one Hand, this includes<br /> examining the systems for already present IT-forensic capabilities, and, on the other hand,<br /> investigating additional possibilities to collect live/memory forensic data, that can be gathered,<br /> using freely available software like Rekall or Proxmox. Additionally, commercial software (Axiom,<br /> EnCase, X-Ways and Nuix) should be looked at, to find out, which possibilities are available,<br /> within those programs. Finally, if possible, a half-automated data collection on Qubes should be<br /> implemented, for later IT-forensic investigation.<br /> <br /> In GERMAN:<br /> Titel: Möglichkeiten der Live/Memory-Forensik auf kompartimentierten Systeme am<br /> Beispiel von Bromium, Qubes und Proxmox<br /> <br /> Abstrakt: Mit der stetig wachsenden Digitalisierung des täglichen Lebens, wächst auch die Anzahl der<br /> Angriffe auf private, wie auch auf Firmen-Computer. Eine der Möglichkeiten den entsprechenden<br /> Risiken entgegenzuwirken, ist die Nutzung von Betriebssystemen oder Software, die<br /> Kompartimente (bzw. Sandboxen oder Container) zur Verfügung stellen. Trotz der geringeren<br /> Risiken besteht auch auf solchen Systemen immer wieder die Notwendigkeit zur Live-/Memory-<br /> Forensik. Diese ist z.B. für VMware recht gut dokumentiert, jedoch gibt es wenig entsprechende<br /> Literatur zu Bromium, Qubes und Proxmox. Daher ist es das Ziel dieser Masterarbeit, die<br /> Live/Memory-forensischen Möglichkeiten auf diesen drei Betriebssystemen zu untersuchen.<br /> Einerseits sollen dabei die bereits vorhandenen Analyse- bzw. Auswertungsmöglichkeiten der<br /> Systeme betrachtet werden und andererseits, welche weiteren Möglichkeiten sich bei Nutzung<br /> von frei verfügbarer Software wie Rekall und Volatility ergeben. Zusätzlich soll betrachtet werden<br /> inwieweit kommerzielle Software, wie Axiom, EnCase, X-Ways und Nuix für eine entsprechende<br /> Untersuchung in Frage kommen. Darüber hinaus, sollte möglichst eine halb-automatisierte<br /> Datensammlung in Qubes implementiert werden, die dann für spätere IT-forensischen<br /> Untersuchungen genutzt werden kann.<br /> <br /> [[Media:MT_Stemplewitz.pdf|Download PDF-Dokument]]</div>

Etduen