This guide explains where evidence resides in Citrix, VDI, and Remote Desktop environments, focusing on session hosts, golden images, and profile stores.
Guide · 17 pages · 23 min read · Published 2026-08-30
Designed for UK legal practitioners dealing with e-discovery and electronic evidence, this publication addresses the misconception that imaging an employee endpoint provides a complete forensic picture when work occurs across Remote Desktop Services, Citrix, or virtual desktop infrastructure. Because the local device often holds almost nothing, instructions must follow the session rather than the screen. The text covers the pivotal distinction between persistent and non-persistent estates, explaining how user data, profile stores, containers, and redirection operate alongside session hosts, golden images, brokers, and gateways. It details what thin traces remain on the endpoint versus where recoverable data actually resides across identity providers, host stores, and logbooks. Incorporating CPR Part 35 expert report standards and chain of custody principles, the material provides practical worked examples including borrowed credentials and nightly environment reverts. Lawyers receive structured interrogatories for clients, opponents, and forensic providers, alongside checklists and red flags to determine when expert laboratory intervention is required to preserve critical evidence before temporary sessions reset.
Read this guide on your phone, open the PDF reader with the full text, browse guides by topic or go back to the full PDF library.
17 pages · 23 min read
Understanding where digital evidence truly resides in virtual desktop infrastructure (VDI) and remote desktop environments is crucial for UK litigators.
Published by Computer Forensics Lab on 2026-08-30. Original material of the practice, free to read, cite and download. See every guide's author and source.
Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.
VDI & REMOTEDESKTOPEVIDENCE · A GUIDE FOR UK LAWYERS Citrix, VDI and Remote Desktop: Where the Evidence Actually Resides Session Hosts, Golden Images, Profile Stores and the Endpoint That Holds Almost Nothing COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM VDI & SESSION-HOST COLLECTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: imaging the window 03 The architectures in plain English: RDS, Citrix, VDI 04 Persistent versus non-persistent: the question that decides everything 05 Where the user's world actually lives: profiles and redirection 06 The connection record: brokers, gateways and session logs 07 What the end point does keep 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: FOLLOWTHESESSION, NOTTHESCREEN
§ 02 · FIRST PRINCIPLES The problem in plain English: imaging the window
§ 03 · THEESTATES The architectures in plain English: RDS, Citrix, VDI
§ 04 · THEDECIDINGQUESTION Persistent versus non-persistent: the question that decides everything
§ 05 · THEUSER ' SREALHARDDRIVE Where the user's world actually lives: profiles and redirection
§ 06 · THELOGBOOK The connection record: brokers, gateways and session logs
§ 07 · THETHINTRACE What the end point does keep
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE GATEWAY END POINT DESKTOP / PROFILE IDENTIT Y DELETED / HOST STORE PROVIDER RECOVERABLE BROKER / LOGS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEEMPTYLAPTOPANDTHEFULLPROFILECONTAINER EXAMPLE2 · THE02: 00SESSIONSANDTHEBORROWEDCREDENTIALS EXAMPLE3 · THENIGHTLYREVERTANDTHEEIGHT - HOURWINDOW
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The VDI / remote desktop checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions The employee only ever used a company laptop. Why isn't imaging it enough? The desktop rebuilds itself every night. Has the evidence been destroyed? Can these environments show us exactly what the user saw on screen? How do we prove which person was behind a session, rather than which account? Work happened through published apps, not a desktop. What changes? Our opponent runs Citrix and says session data "is not retained". How do we test that?
§ 14 · REFERENCE Glossary VDI Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
18 pages · 26 min read
This guide for UK lawyers addresses the complexities of recovering data from RAID arrays, Network Attached Storage, and servers.
17 pages · 23 min read
Understanding where digital evidence resides in Citrix, VDI, and Remote Desktop environments is crucial for UK litigators.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.
