Forensic Analysis on QEMU

QEMU is a generic and open source machine emulator and virtualizer. Snapshots in Qemu are stored inside the image itself where the guest OS is installed. Patches have been submitted for qemu to store the snapshot file in the home directory. In this paper we have explained the modifications done to the qemu source code by which snapshots can be stored in the user specific location in the computer for forensic analysis. In this paper we also discussed about snapshot comparisons.