Hypervisor-hosted virtual machine forensics

A computer-implemented method performed by a computer system to acquire forensics data from running virtual machines, the computer-implemented method comprising:

• implementing a hypervisor that runs a hypervisor-hosted virtualization environment that includes a root virtual machine partition, an enlightened child virtual machine partition that is hypervisor-aware, and an unenlightened child virtual machine partition that is non-hypervisor-aware;
• providing a forensics partition that is hosted by the hypervisor and includes a forensics service application programming interface configured to target a virtual machine;
• routing a first request for forensics data, from the forensics service application programming interface to the enlightened child virtual machine partition, via an inter-partition communication mechanism supported by the virtualization environment hosted by the hypervisor;
• receiving, at the forensics service application programming interface, a first response to the first request via the inter-partition communication mechanism, wherein the first response is indicative of forensics data obtained from the enlightened child virtual machine partition;
• based on a determination that the unenlightened child virtual machine partition does not support the inter-partition communication mechanism, automatically implementing a forensics switch at the root virtual machine partition;
• routing a second request for forensics data from the forensics service application programming interface to the forensics switch;
• providing, by the forensics switch to the forensics service application programming interface, a second response to the second request, wherein the second response is indicative of forensics data obtained from the unenlightened child virtual machine partition;
• and
• exposing the forensics service application programming interface to a forensics tool.

A computing system comprising:

• at least one processor;
• and
• memory storing instructions which, when executed by the at least one processor, configure the computing system to provide:
• a hypervisor configured to run a hypervisor-hosted virtualization environment including a root virtual machine partition, an enlightened child virtual machine partition that is hypervisor-aware and configured to support an inter-partition communication mechanism of the virtualization environment, and an unenlightened child virtual machine partition that is non-hypervisor-aware;
• and
• a forensics partition that is hosted by the hypervisor and includes a forensics service application programming interface configured to:
• route a first request for forensics data to the enlightened child virtual machine partition via the inter-partition communication mechanism;
• receive first forensics data in response to the first request via the inter-partition communication mechanism;
• based on a determination that the unenlightened child virtual machine partition is non-hypervisor-aware, automatically configure a forensics switch in the root virtual machine partition;
• route a second request for forensics data to the unenlightened child virtual machine partition via the forensics switch;
• receive second forensics data in response to the second request via the forensics switch;
• and
• wherein the forensics service application programming interface is exposed to a forensics tool.