Page 1
VIRTUALMACHINEEVIDENCE · A GUIDE FOR UK LAWYERS Virtual Machines as Evidence VMware, Hyper-V, Snapshots, Virtual Disks and the Recovery of Historical States COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the computer that is a file 03 The anatomy of a VM: disks, snapshots, memory, configuration 04 Acquiring virtual machines defensibly 05 Historical states: snapshot chains, backups and rollback 06 The hypervisor's own record: lifecycle, logs and attribution 07 Hidden and deleted VMs 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: APERFECTCOPYISONEFILEOPERATIONAWAY, AND SO IS A PERFECTDISAPPEARANCE
§ 02 · FIRST PRINCIPLES The problem in plain English: the computer that is a file
§ 03 · ANATOMY The anatomy of a VM: disks, snapshots, memory, configuration
Page 2
§ 04 · ACQUISITION Acquiring virtual machines defensibly
§ 05 · TIMETRAVEL Historical states: snapshot chains, backups and rollback
§ 06 · ONEFLOORUP The hypervisor's own record: lifecycle, logs and attribution
§ 07 · THECONCEALEDANDTHEDESTROYED Hidden and deleted VMs
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE EXTERNAL VM / BACKUP REPLICA / HYPERVISOR DELETED / CHAIN CATALOGUE EXPORT LOGS RECOVERABLE GUEST'S FOOTPRINT
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEROLLED - BACKWEEK EXAMPLE2 · THECOMPANYONAPORTABLEDRIVE EXAMPLE3 · THEDELETEDGUESTANDTHEBACKUPCATALOGUE
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORAVMEXAMIN AT ION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The VM evidence checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Is a copied VM as good as imaging the original server? Someone reverted the machine to an old snapshot. Is the interval gone? A VM was deleted before we could act. What are the odds? Can we make the other side disclose hypervisor logs and backup catalogues? The disputed VM runs in Azure/AWS, not on our opponent's own servers. Does the approach change? We suspect an employee ran a hidden VM on their laptop. What should we ask for?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Virtual Machines As Evidence, Computer Forensics Lab, https://e-discovery.uk/library/virtual-machines-as-evidence/pdf.