Forensics of Virtualization Products - Revision history

Pmow: moved VirtualMachineForensics to Forensics of Virtualization Products: The title can easily refer to using virtualization in your forensics practice.

2012-03-23T17:10:12Z

moved VirtualMachineForensics to Forensics of Virtualization Products: The title can easily refer to using virtualization in your forensics practice.

ElizabethS: /* Convert */

2011-10-01T00:25:13Z

‎Convert

ElizabethS: /* Mount */

2011-10-01T00:24:19Z

‎Mount

ElizabethS: Created page with "Category:Howtos == Dealing with Virtual Machine Images == It is becoming increasingly common to find evidence drives with Virtual Machines (VM) on them. The VMs may contai..."

2011-10-01T00:23:48Z

Created page with "Category:Howtos == Dealing with Virtual Machine Images == It is becoming increasingly common to find evidence drives with Virtual Machines (VM) on them. The VMs may contai..."

New page

[[Category:Howtos]]

== Dealing with Virtual Machine Images ==

It is becoming increasingly common to find evidence drives with Virtual Machines (VM) on them. The VMs may contain evidence of their own, but with their unique file structure, care must be taken during examination. Running the virtual machine could destroy artifacts that are important.

=== Virtual Box ===

There are two methods for creating a way to mount or inspect a Virtual Box VM. Virtual Box disks typically have the extension "vdi" for Virtual Desktop Infrastructure. The mount method requires a Linux system and "qemu". The other method converts a vdi to a raw image format which can then be inspected with traditional forensics tools.

==== Mount ====

## Install qemu-kvm using your preferred installation tool (apt-get, etc)
## Load the network block device module >sudo modprobe nbd
## Use Qemu to load the VDI file as a loop back device >sudo qemu-nbd -c /dev/nbd0 infile.vdi
## Mount >sudo mount /dev/nbd0p1 /mnt
## Inspect the file system as needed

To undo:
## >sudo umount /mnt
## >qemu-nbd -d /dev/nbd0

[http://bethesignal.org/blog/2011/01/05/how-to-mount-virtualbox-vdi-image/]

==== Convert ====

Conversion requires the Virtual Box tool kit, if you don't already have it.

## Install virtualbox-ose using your preferred installation tool (apt-get, download from VirtualBox.org, etc)
## Convert to raw format >VBoxManage internalcommands converttoraw infile.vdi outfile.img
## Inspect the raw image as per usual, either with TSK, EnCase, or mount

=== VMWare ===

@@ Line 27: / Line 27: @@
 Conversion requires the Virtual Box tool kit, if you don't already have it.
-## Install virtualbox-ose using your preferred installation tool (apt-get, download from VirtualBox.org, etc)
+# Install virtualbox-ose using your preferred installation tool (apt-get, download from VirtualBox.org, etc)
-## Convert to raw format  >VBoxManage internalcommands converttoraw infile.vdi outfile.img
+# Convert to raw format  >VBoxManage internalcommands converttoraw infile.vdi outfile.img
-## Inspect the raw image as per usual, either with TSK, EnCase, or mount
+# Inspect the raw image as per usual, either with TSK, EnCase, or mount
 === VMWare ===

@@ Line 11: / Line 11: @@
 ==== Mount ====
-## Install qemu-kvm using your preferred installation tool (apt-get, etc)
+# Install qemu-kvm using your preferred installation tool (apt-get, etc)
-## Load the network block device module  >sudo modprobe nbd
+# Load the network block device module  >sudo modprobe nbd
-## Use Qemu to load the VDI file as a loop back device  >sudo qemu-nbd -c /dev/nbd0 infile.vdi
+# Use Qemu to load the VDI file as a loop back device  >sudo qemu-nbd -c /dev/nbd0 infile.vdi
-## Mount  >sudo mount /dev/nbd0p1 /mnt
+# Mount  >sudo mount /dev/nbd0p1 /mnt
-## Inspect the file system as needed
+# Inspect the file system as needed
 To undo:
-## >sudo umount /mnt
+# >sudo umount /mnt
-## >qemu-nbd -d /dev/nbd0
+# >qemu-nbd -d /dev/nbd0
 ==== Convert ====