Edward Haletky's Blog

VMworld and Forensics

VizionCore and PHD produce backup tools that do block level backups of VMs that are verified via checksums with the originally. If these checksums in use are SHA1 checksums then the full vmdk backup could be forensically sound. In addition to this, full VM backups using these tools can include a memory image of the currently running VM.

This implies that backup tools which are not normally used by forensic scientists could be used in the case of VMware ESX hosts.

The following commands can get this information as well:

$WID=`vm-support -x | grep vmname | awk '{print $1}'`
vm-support -X $WID

The -x option grabs the world id of the VM and the -X grabs the memory image. You can do the same thing with a snapshot as well.

However, it does say that grabbing the memory image in this way could mutate the VM in some undisclosed way.

More research may be needed for these steps but the ability to create snapshots and grab the memory image of a running VM increase the abilities of forensic scientists. In addition, with backups being block level backups, backups can now be analyzed as well.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world