VMWare Forensics

thegavster · 2009-01-15T17:43:49Z

Hi guys. As my university project i have decided to investigate virtual machines. In particular what inforamtion is left behind on a HDD when the virtual machine O/S has ben closed down. I would be looking at what data files can be found. For example images, browsing habbits, videos etc. My method of investigation would be taking a "forensic image" using FTK or enCase of the physical HDD. Then install Windows XP pro on VMWare on this physical drive. Add various data files to the VM. Then take another image of the HDD, then compare the two images. Would this be a sound forensic method, and would it produce any results. Anyone with experience with this work would be greatly appreciated.Gavin

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by solal 15 years ago

11 Posts

10 Users

0 Reactions

3,256 Views

RSS

solal

(@solal)

Active Member

Joined: 17 years ago

Posts: 10

16/06/2011 2:38 pm

You could look at this blogspot http//www.digital-forensic.org/blog/post/7/ it explain how to do vmware .vmdk analysis using DFF (an open source digital forensics framework)

ReplyQuote

Page 2 / 2 Prev