Even More Thoughts on Forensics
Acquiring disks is a very important part of digital forensics. In my past blogs I discussed some aspects of forensics with respect to VMware ESX servers. This is the last part of the series.
To acquire a VM from a VMFS you must use a forensically sound method. One that duplicates the blocks used by the VM disk, memory, and meta files. Not a method that makes a copy. A copy is not an exact copy as file slack space (the space unused within a block) is ignored. We want this space.
There are several tools that will do this, but only one is currently available on all VMware ESX/ESXi. This is the dd tool. dd will allow you to duplicate the blocks used by the files and not just the files themselves. To copy a file or a directory you need to have some remote or USB storage available that is big enough to hold the data you want to duplicate.
Assuming a USB location that resides on device /dev/sde with a filesystem residing on /dev/sde1 mounted on /mnt/usbdevice, you can use the following to forensically copy a VMs files.
cd /vmfs/volumes/VMName; for x in `ls *.vm*`; do dd if=$x of=/mnt/usbdevice/VMName.vmdk; done
This will make a forensically sound duplicate of the files the comprise the VM. dd has many options, but will use the default blocksize of the file system from which the input file (if option) resides.
Remember to use dd to duplicate minimally the .vmdk, .vmx, .vmsn, and .vswp files.
Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world
Esther Schindler
If the comments are ugly, the code is ugly
claird
SVG a graphics format for 21st century
pasmith
Take Chrome OS for a test spin
Sandra Henry-Stocker
Solaris Tip: Have Your Files Changed Since Installation?
jfruh
Android fragments vs. the iPhone monolith
mikelgan
What Gizmodo missed about the Pro WX Wireless USB disk drive
Sidekick: The Good News & the Bad News
Either way you look at it Microsoft Data Center management did not follow standards or best practices in this failure. In which case it makes me wonder more about the outsourcing of corporate data much less personal data.
- mburton325
Join the conversation here
Quick, practical advice for IT pros. Made fresh daily.
Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.
Hi, There appear to be a few
Hi,There appear to be a few flaws with your post.
For starters, your dd command will overwrite the output file for each of the files in the *.vm* glob, meaning you will only actually end up with the last one that matched. Perhaps you meant to put the $x somewhere in the output path also?
Secondly, I've never used ESX, but it appears that you are accessing the files on a mounted filesystem on the host (some embedded linux IIRC). So what exactly is the point of using 'dd' anyway? 'dd' in this context is ultimately reading from a logical file, not a block device. 'cp' will do exactly the same job.
Dave
I'm a user of VMWare
I'm a user of VMWare Workstation, not ESX. However, from the above command line, it appears that ESX uses .vmdk files, so simply documenting and copying the entire .vmdk file off of the system for analysis has worked very well for me during engagements. Both FTK Imager and EnCase will allow you to open the .vmdk file and acquire images, without requiring any further VMWare products.For the contents of memory, pausing a VM will create a .vmem file...this is analogous to a dd dump of RAM, and can be analyzed using the available tools.
H. Carvey
http://windowsir.blogspot.com
Hello, Re: Using cp Actually
Hello,Re: Using cp
Actually cp will not do the same job as it does not copy the underlying blocks of the file, but the content of the file. Things are slightly different there. Not if you want true 'duplication' of the underlying blocks. You can use dd to copy files as well as full devices. Unfortunately, until the spec for the VMFS is released, this is the best you can do. dd gives me the opportunity to define the size of the block as well.
Re: Workstation
ESX uses a Virtual Machine File System to store VMs unlike WorkStation. Since this is unknown to tools like EnCase and FTK, you need to use different mechanisms to get the data off the system.
Best regards
Edward L. Haletky
AstroArch Consulting, Inc.