Virtualization and Forensics

5 Investigating Dead Virtual Environments

Information in This Chapter

• Install Files

• Remnants

• Registry

• Microsoft Disk Image Formats

• Data to Look for

• Investigator Tips

Traditionally, investigators have used virtual machines to create contained environments for malware isolation or to view the environment as a suspect used it. Suspect machines. For example, VMware can be used to mount a dd image, and applications such as LiveView and Virtual Forensic Computing (VFC) can be used to create a VMware virtual machine from a raw disk image or physical disk. VFC uses a combination of VMware's VMPlayer and forensic disk mount tool Mount Image Pro to create and mount the disk. This allows the forensic examiner to boot the image or the disk in ...