292 Cyber seCurity essentiAls
prepare the system for the next analysis and makes up a significant
portion of the analysis time.
Virtualization systems like VMWare and VirtualBox have many
features that make them an excellent choice when developing an
AMAS. ese programs allow a user to run one or many virtual
computer(s) on top of another OS. Researchers use these systems
to run many analysis instances on a single physical computer, sav-
ing time, power, and money. Virtual machines (VM) also have the
ability to store a clean “snapshot” of the operating system. After the
analysis is complete, restoring the system to the clean snapshot typi-
cally takes less than 30 seconds; however, as with active analysis sys-
tems, it is possible for malicious ...