VMworld and Forensics

By  

VizionCore and PHD produce backup tools that do block level backups of VMs that are verified via checksums with the originally. If these checksums in use are SHA1 checksums then the full vmdk backup could be forensically sound. In addition to this, full VM backups using these tools can include a memory image of the currently running VM.

This implies that backup tools which are not normally used by forensic scientists could be used in the case of VMware ESX hosts.

The following commands can get this information as well:

$WID=`vm-support -x | grep vmname | awk '{print $1}'`
vm-support -X $WID

The -x option grabs the world id of the VM and the -X grabs the memory image. You can do the same thing with a snapshot as well.

However, it does say that grabbing the memory image in this way could mutate the VM in some undisclosed way.

More research may be needed for these steps but the ability to create snapshots and grab the memory image of a running VM increase the abilities of forensic scientists. In addition, with backups being block level backups, backups can now be analyzed as well.

Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

Answers - Powered by ITworld

ITworld Answers helps you solve problems and share expertise. Ask a question or take a crack at answering the new questions below.

Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

Ask a Question