Investigations & Virtualization

Someone once described virtualization as something you pay for but don't actually get. Client virtualization offers a similar analogy: A virtual machine is software that runs on a computer and allows a single host to appear as if it were itself a computer.

It's a technology that offers many benefits, but it also changes the nature of digital forensics investigations. VMs are increasingly the target or instrument of nefarious activity, but they are also used as the platform on which to perform examinations. The following tips can help digital forensics examiners familiarize themselves with virtualized client environments and their impact on computer forensics investigations.

1. Use the tool.

DFEs should implement a VM on their own computer so that they understand how it is used. For example, install VM software, such as Parallels Desktop for Mac, Microsoft VirtualPC or VMware Workstation, on the host computer. To add a guest OS, start the VM application, configure a few parameters such as the amount of disk space and memory to allocate for the new VM, then install the guest OS. This also provides an inexpensive way to gain experience with other OSes.

2. Learn what kind of traces VMs leave behind.

One difficulty that VMs present to DFEs is that the guest environment is fully self-contained in a small set of files on the host system. The examiner has to find the VM files in order to recover the guest OS and its contents. For example, VMware Fusion on a Mac stores the VM environment in a file with the extension .vmwarevm, while VMware on the PC uses a series of files with file extensions such as .vmdk, .nvram and .vmx. The VM files are often stored in directories with a name like "Virtual Machines."

The Windows Registry also maintains information that might be useful in finding VMs. Most Recently Used keys may provide pointers to VM application software, while File Associations keys will show the link between a VM application and relevant file extensions -- sometimes, even if the application has been removed from the system. Finally, traces of VMs may be found in the process list within RAM.

3. Dust off your imaging skills.

Because the VM is an environment inside of the host system, there are different methods that need to be considered for forensically imaging the guest OS environment.

1. Start the guest OS in a forensically sound environment and perform a live image of the VM as you would a live image on any other computer.
2. Use imaging software that can open the guest OS from the VM files (for example, FTK Imager).
3. Employ an application, such as VMware Disk Mount, that can mount the VM as a physical drive, which can then be imaged.

Once imaged, the VM can be examined using the same tools and methods as a traditional system with that OS.

4. Use client virtualization to aid in the examination process.

There are some situations where it would be useful to actually boot up a suspect computer, an action that is counter to all digital forensics best practices. One solution is to boot the suspect system into a VM from the suspect computer's image files. In this way, the examiner can see exactly what a user would see on the suspect computer without ever actually touching, and possibly altering, the suspect computer. LiveView is one such tool that can create a VMware virtual machine from raw (dd) image files.

5. Use virtualization in the examination environment.

Some computer forensics labs save a known, stable forensics environment as a VM and load a new VM for each new examination. In this way, all examinations start out in a forensically clean state, and a snapshot of the examination system is always available to this, or another, examiner.