Page 1

VIRTUALMACHINEEVIDENCE · A GUIDE FOR UK LAWYERS Virtual Machines as Evidence VMware, Hyper-V, Snapshots, Virtual Disks and the Recovery of Historical States COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the computer that is a file 03 The anatomy of a VM: disks, snapshots, memory, configuration 04 Acquiring virtual machines defensibly 05 Historical states: snapshot chains, backups and rollback 06 The hypervisor's own record: lifecycle, logs and attribution 07 Hidden and deleted VMs 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: APERFECTCOPYISONEFILEOPERATIONAWAY, AND SO IS A PERFECTDISAPPEARANCE

§ 02 · FIRST PRINCIPLES The problem in plain English: the computer that is a file

§ 03 · ANATOMY The anatomy of a VM: disks, snapshots, memory, configuration