Thoughts on Virtualization Forensics

Acquiring disks is a very important part of digital forensics. In my past blogs I discussed some aspects of forensics with respect to VMware ESX servers. This is the last part of the series. To acquire a VM from a VMFS you must use a forensically sound method. One that duplicates the blocks used by the VM disk, memory, and meta files…

More (IT World)

Leave a Comment