VMworld and Forensics
VizionCore and PHD produce backup tools that do block level backups of VMs that are verified via checksums with the originally. If these checksums in use are SHA1 checksums then the full vmdk backup could be forensically sound. In addition to this, full VM backups using these tools can include a memory image of the currently running VM.
This implies that backup tools which are not normally used by forensic scientists could be used in the case of VMware ESX hosts.
The following commands can get this information as well:
$WID=`vm-support -x | grep vmname | awk '{print $1}'`
vm-support -X $WID
The -x option grabs the world id of the VM and the -X grabs the memory image. You can do the same thing with a snapshot as well.
However, it does say that grabbing the memory image in this way could mutate the VM in some undisclosed way.
More research may be needed for these steps but the ability to create snapshots and grab the memory image of a running VM increase the abilities of forensic scientists. In addition, with backups being block level backups, backups can now be analyzed as well.
Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world
Esther Schindler
If the comments are ugly, the code is ugly
claird
SVG a graphics format for 21st century
pasmith
Take Chrome OS for a test spin
Sandra Henry-Stocker
Solaris Tip: Have Your Files Changed Since Installation?
jfruh
Android fragments vs. the iPhone monolith
mikelgan
What Gizmodo missed about the Pro WX Wireless USB disk drive
Where Google Chrome security fails: the password
I heard mention that the Chrome OS will have some sort of encryption available a la bitlocker. If it's possible to encrypt personal data using another password or key, then it may have potential for very secure data.... And Ubuntu has an 'encrypt home directory' option, perhaps google should follow suit.
- Dann
Join the conversation here
Quick, practical advice for IT pros. Made fresh daily.
Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.
