With the massive data storage in the cloud environment, gathering bit-level evidence from byte-level data is a challenging task during cloud forensics. To resolve this complexity and support the dynamic evidence collection, the cloud forensics system recently put more effort into focusing on Virtual Machine (VM) monitoring. VM Introspection (VMI) mechanism provides the snapshots through Virtual Machine Monitoring (VMM). Hence, developing the cloud forensics solution with the assistance of the virtual machine introspection provides the potential benefits to the investigation as well as ensures the trustworthy investigation.