7 Finding and Imaging Virtual Environments
Information in This Chapter
- • Detecting Rogue Virtual Machines
- • Is It Real or Is It Memorex?
- • Imaging Virtual Machines
- • Snapshots
- • VMotion
- • Identification and Conversion Tools
- • Environment to Environment Conversion
As an investigator, especially in a live environment, it may be necessary to find and image rogue virtual machines (VMs). Additionally, there may be the need to acquire virtual machine snapshots and use conversion tools. The investigator may have to determine if the environment is indeed physical or virtual. More importantly, the investigator may have to testify to the type of environment examined in court.
Detecting Rogue Virtual Machines
In principle, rogue VMs are no different ...
Get Virtualization and Forensics now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
