VMworld and Forensics
VizionCore and PHD produce backup tools that do block level backups of VMs that are verified via checksums with the originally. If these checksums in use are SHA1 checksums then the full vmdk backup could be forensically sound. In addition to this, full VM backups using these tools can include a memory image of the currently running VM.
This implies that backup tools which are not normally used by forensic scientists could be used in the case of VMware ESX hosts.
The following commands can get this information as well:
$WID=`vm-support -x | grep vmname | awk '{print $1}'`
vm-support -X $WID
The -x option grabs the world id of the VM and the -X grabs the memory image. You can do the same thing with a snapshot as well.
However, it does say that grabbing the memory image in this way could mutate the VM in some undisclosed way.
More research may be needed for these steps but the ability to create snapshots and grab the memory image of a running VM increase the abilities of forensic scientists. In addition, with backups being block level backups, backups can now be analyzed as well.
Win an Amazon Kindle!
This month's giveaway gadget - Amazon's Kindle - will keep you entertained on the long trip home to visit family and friends over the holidays. Enter the drawing now!
Applied Security Visualization
By Raffael Marty
Published by Addison-Wesley Professional
Learn more!

IT Manager's Handbook
By Bill Holtsnider and Brian D. Jaffe
Published by Morgan Kaufmann
Learn more!

Windows Vista Resource Kit
By Mitch Tulloch, Tony Northrup, and Jerry Honeycutt
Published by Microsoft Press
Learn more!








