Virtualisation has become an essential platform for many organisations in recent years, because it provides them with information technology tools that enable them to become much more efficient. Most of those who have implemented virtualisation are reaping a number of benefits, such as greater availability of services, less need for computer equipment, fewer man hours spent on hardware maintenance and increased security, to name just a few.

What is virtualisation?

Virtualisation consists of a physical computer (known as a host) that uses a virtualisation programme to simulate the existence of a second computer (known as a guest). In fact, the guest does not physically exist; it forms part of a virtual environment on the host computer. Even so, it can function independently and it can even run a different Operating System (OS) from that of the host. For example, while the host computer may be running any Microsoft Windows OS, such as Windows Server 2003, the virtualisation programme can be used to install Linux as the guest's OS. There is no limit to the number of guest OS's that can be installed on the same host computer, provided it is equipped with enough resources, such as CPU, memory and storage space.
 
An organisation can use this basic concept of virtualisation to run a number of virtual guest computers that share one physical host computer's resources. These can function safely and without interfering with one another. Depending on its size, the organisation can replace a number of physical servers with just one or a few. Having fewer physical servers to power up and administer means the organisation can reduce its hardware maintenance, manpower and other network infrastructure costs over a period of time.

Why virtualisation?

Let's take a step back and look at traditional network infrastructure. Before virtualisation, most physical servers were given a single job to do, while others were given more than one, perhaps due to limited resources. A file server that provides network storage for work files – like Word documents, Excel spreadsheets and PowerPoint presentations – technically does not need a lot of server resources. In fact, its CPU power and memory are seldom fully used.
 
A virtualisation programme can harness the file server's surplus resources and give them a new function. In this way it can be used to consolidate a number of different server roles (e.g. network print server, accounts application server or even content filtering server) by making it possible for many of them to be hosted by a single server.
 
Creating virtual servers in this way enables organisations to reduce the number of physical servers they use by 15% to 20% or more, depending on the size of their existing network infrastructure.
 
Others benefits of moving towards a virtual environment include:

• improved disaster recovery – a virtual image can be restored much more quickly and easily than the traditional method of reinstalling the OS, required applications and, finally, the data. So it has the potential to increase a server's availability by reducing downtime;

• independence and isolation – multiple OS's, such as Windows Server 2003 and Linux, can all run simultaneously on the same host computer, as the virtualisation programme treats each virtual server as if it were an independent physical server;

• independence of hardware – because virtualisation does not associate the physical servers hardware to the guest OS, the guest OS does not necessarily require the same physical server that it was previous hosted on. Thus will ease the pain of replacing computer hardware should it fail and deemed irreplaceable should the specific component be obsolete;

• software vulnerability patches may be tested more easily in a virtual server before they are deployed in a live production environment.

Other major advantages

As you can imagine, the benefits of virtualisation extend far beyond its ability to improve traditional network infrastructure. Indeed, it can play a positive role in providing organisations with a much more manageable information system. Yet, on the other hand, it can also help investigators and incident responders conduct a preliminary examination of computer evidence that they have forensically acquired from an original physical computer in the form of a bit-by-bit image. It does this by enabling them to review that image within a virtualisation programme that simulates the original physical computer. Using virtualisation, they can look for clues, run diagnostic tools and observe any unusual processes that may identify the potential cause of the failure, while at the same time not contaminating the original physical computer further.
 
Actually seeing an image on a screen can be far more effective than hearing it described in words. Virtualisation can therefore be used in computer forensics to illustrate evidence to a lay client. In rare instances, it can also be shown to the court of law, in cases where the identified relevant evidence may have appeared in its original format on the original physical computer. Using virtualisation and computer forensic tools, the original computer does not need to be used or even turned on at any time; only a virtual image of the original physical computer is seen.

Generally speaking, the ability of virtualisation to consolidate the use of physical servers has made it the trend among organisations who wish to improve security and reduce overhead costs, as well as the amount of office space devoted to housing their network. Finally, it can be used as an important tool to help investigators and incident responders efficiently pinpoint the cause of a potential problem, and as an effective method for increasing the availability of servers to end-users by improving disaster-recovery procedures.