Cloud forensics and incident response platform

A computer system for performing cloud forensics and incident response, the computer system comprising:

• a bus system;
• a storage device connected to the bus system, wherein the storage device stores program instructions;
• and
• a processor connected to the bus system, wherein the processor executes the program instructions to:
• intercept communication between a virtual machine (VM) and a hypervisor;
• and
• extract data from the communication between the VM and the hypervisor according to a forensic policy,
• wherein executing the instructions to intercept and to extract are transparent to the VM and to the hypervisor,
• wherein executing the instructions to intercept and extract are performed without knowledge of the VM and of the hypervisor, and
• wherein the intercepting and the extracting are performed independent of the VM.

A computer program product for performing cloud forensics and incident response, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:

• intercepting communication between a virtual machine (VM) and a hypervisor;
• and
• extracting data from the communication between the VM and the hypervisor according to a forensic policy,
• wherein intercepting and the extracting are transparent to the VM and to the hypervisor,
• wherein the intercepting and the extracting are performed without knowledge of the VM and of the hypervisor, and
• wherein the intercepting and the extracting are performed independent of the VM.