±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 31952
New Yesterday: 1 Visitors: 75

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Recoverability of data from virtual machine - advice needed

Computer forensics training and education issues. If you are looking for topic suggestions for your project, thesis or dissertation please post here rather than the general discussion forum.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2, 3 
  

Re: Recoverability of data from virtual machine - advice nee

Post Posted: Mon Mar 06, 2017 12:48 pm

Thanks Jaclaz!

I recommended a full physical image be made of the workstation to my client.  

UnallocatedClusters
Senior Member
 
 
  

Re: Recoverability of data from virtual machine - advice nee

Post Posted: Mon Mar 13, 2017 9:51 pm

- StudentofLife

At one point my host OS got corrupted. I then reinstalled the OS on my host, created a VM in VMware Workstation, installed an OS onto this, sent 3 emails within the VM, imaged the host, extracted the VM, imaged the VMDK in FTK Imager + Toolkit and I'm able to find traces of the email I sent in the VM which was active before the corruption occurred - how? What could be deemed an 'unfit disk creation procedure/tool' in these scenarios?


During disk creation, the space allocated to the (fixed size) virtual disk file is usually zeroed. VPS and cloud providers had some huge problems otherwise. I don't use VMware Workstation on a regular basis, but doesn't it do the same (even as a desktop, not infrastructure product)? Some third party tools surely create fixed size VM disks without zeroing, which I described as unfit.  

C.R.S.
Senior Member
 
 
  

Re: Recoverability of data from virtual machine - advice nee

Post Posted: Tue Mar 14, 2017 1:06 pm

Thank you so much for all of your help!
I really appreciate it and I realise that I have a lot to learn...1 step at a time
Thank you again!  

StudentofLife
Newbie
 
 
  

Re: Recoverability of data from virtual machine - advice nee

Post Posted: Tue Mar 14, 2017 1:09 pm

During disk creation, the space allocated to the (fixed size) virtual disk file is usually zeroed. VPS and cloud providers had some huge problems otherwise. I don't use VMware Workstation on a regular basis, but doesn't it do the same (even as a desktop, not infrastructure product)? Some third party tools surely create fixed size VM disks without zeroing, which I described as unfit.



Apparently not - but thank you for bringing this to my attention. It's definitely something that I'll look into.  

StudentofLife
Newbie
 
 

Reply to topicReply to topic

Share and Like this forum topic to get more replies




Page 3 of 3
Go to page Previous  1, 2, 3