Hypervisor
Definition
Software or firmware that creates and runs virtual machines. Type 1 runs on bare metal (ESXi, Xen, KVM, Hyper-V Server). Type 2 runs on a host operating system (VirtualBox, VMware Workstation, Parallels).
- Type 1 examples
- ESXi, Xen, KVM, Hyper-V Server, run on bare metal
- Type 2 examples
- VirtualBox, VMware Workstation, Parallels, run on a host OS
- Function
- Creates and manages virtual machines
- Field
- Cloud and virtualization forensics
Common questions
Why does the hypervisor type matter to a digital forensic investigator?+
A Type 1 hypervisor sits closer to the hardware and often exposes centralized logs and snapshot storage useful for evidence collection, while a Type 2 hypervisor's evidence is typically captured by imaging the host operating system that runs it, changing where investigators must look first.
What forensic artefacts does a hypervisor typically generate?+
Virtual disk files, VM snapshots, configuration files recording resource allocation and network settings, and hypervisor-level logs of VM creation, migration, and shutdown events are all common artefacts that can establish a timeline of virtual machine activity.
Related terms
- BYOK / HYOK
- Bring Your Own Key lets the customer supply the master key to a provider KMS, the provider stores it. Hold Your Own...
- MeghRaj
- The Government of India cloud initiative launched in 2014 as the GI Cloud, providing shared cloud infrastructure for central and state government...
- MeitY Empanelment
- The Indian Ministry of Electronics and IT framework that certifies cloud service providers fit for government workloads. AWS, Azure, GCP and OCI...
- NIST SP 800-145
- The 2011 NIST Special Publication that codified the definition of cloud computing as five essential characteristics, three service models (IaaS, PaaS, SaaS)...
- Shared Responsibility Model
- The cloud security split where the provider secures the underlying infrastructure (security of the cloud) and the customer secures their data, identity,...