I'm new the mac world and looking for some help. I'm looking to be able to create a virtual machine on Mac, like using VM workstation on a PC. I've looked into VM Fusion and everything I find about it says you can run a windows machine in a Mac. Is anyone using fusion to virtually look at a suspect's mac or is there another program that will do that?
Thank you in advance,
Not sure exactly what you mean. Fusion lets you run a windows based VM on a Mac. There is no legal (eula) way to run a Mac OS VM unless you buy OS X Server. Are you asking if you can use a Fusion Windows based VM to look at a Mac with the usual tools? If so it would be possible by using various techniques like target disk mode and a firewire writeblocker or imaging the Mac and using Windows forensic tools in a Windows VM to analyze the image. This is quite common among LE. There are also specific tools that run on a Mac that do the job such as the Blackbag Suite and SubRosa's Mac Forensics Lab. You can also run Sleuth Kit and Autopsy (both opensource/freeware) from a Mac that can see and interpret the Mac file system but you need to compile these from source code.
I'll try to be a clearer about what I want to do. I want to know if it is possible to use my mac to somehow view a suspect's Mac computer virtually on mine. I'm currently doing that wiht VM workstation with my windows images. Thanks in advance.
I'll try to be a clearer about what I want to do. I want to know if it is possible to use my mac to somehow view a suspect's Mac computer virtually on mine. I'm currently doing that wiht VM workstation with my windows images. Thanks in advance.
OK you want to make a VMware machine from a Mac and then run it on your machine "live" so to speak. You might be able to use Liveview to do this from a dd image but I haven't tried it and your mileage may vary. I run Fusion and I wouldn't classify it as forensically sound but LiveView is.
If you want to run in a somewhat "non-forensic" manner you could use something like CarbonCopy Cloner to make a clone of the subject machine and boot _your_ machine with the clone. I do that when I want my Macbook environment at work, I just boot my work MacPro with the clone of my MacBook.