Analysis of Virtual Machine File Forensic
XU Rong-sheng · Jisuanji gongcheng · 2010
This paper introduces the structure and meanings of virtual machine disk file under VMware Workstation software.And the approach for the virtual machine files for judicial need is analyzed.According to the file storage structure in the partition file system,it scans the virtual machine file to locate the sector in the virtual host of the virtual machine disk file for accessing to evidence.Taking virtual hard disk partition to NTFS file system as an example,it discusses some forensic strategies under a virtual machine.