My company will be using VMWare View Persona to create linked cloned machines. Basically, we will have a golden VM snapshot that will spawn cloned virtual machines. Each clone will be able to be edited, but the original golden VM snapshot will remain the same.
The issue is IT wants the ability to delete the clones at anytime and rebuild them from the golden VM snapshot. Does anyone currently have a similar setup in their environment and can offer some advice on best practices for being able to do forensics on the cloned machines?
We do not want to take snapshots of the clones and back them up. We are mainly interested in being able to get the registry information from the clones. Do we need to copy the entire VMDK file or are their other files we could copy/backup to get Windows registry information?
We do not want to take snapshots of the clones and back them up. We are mainly interested in being able to get the registry information from the clones. Do we need to copy the entire VMDK file or are their other files we could copy/backup to get registry information?
You mean the Windows registry? I think you could write a script or an application that mounts the VMDK with vmware-mount and gets the registry files out.