Virtual Machines As Evidence

VIRTUALMACHINEEVIDENCE · AGUIDEFORUKLAWYERS Virtual Machines as Evidence VMware, Hyper-V, Snapshots, Virtual Disks and the Recovery of Historical States COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the computer that is a file 03 The anatomy of a VM: disks, snapshots, memory, configuration 04 Acquiring virtual machines defensibly 05 Historical states: snapshot chains, backups and rollback 06 The hypervisor's own record: lifecycle, logs and attribution 07 Hidden and deleted VMs 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : APERFECTCOPYISONEFILEOPERATIONAWAY , ANDSOISA PERFECTDISAPPEARANCE § 0 2 · FIRSTPRINCIPLES The problem in plain English: the computer that is a file § 0 3 · ANATOMY The anatomy of a VM: disks, snapshots, memory, configuration § 0 4 · ACQUISITION Acquiring virtual machines defensibly § 0 5 · TIMETRAVEL Historical states: snapshot chains, backups and rollback § 0 6 · ONEFLOORUP The hypervisor's own record: lifecycle, logs and attribution § 0 7 · THECONCEALEDANDTHEDESTROYED Hidden and deleted VMs § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE EXTERNAL VM / BACKUP REPLICA / HYPERVISOR DELETED / CHAIN CATALOGUE EXPORT LOGS RECOVERABLE GUEST'S FOOTPRINT § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEROLLED - BACKWEEK EXAMPLE2 · THECOMPANYONAPORTABLEDRIVE EXAMPLE3 · THEDELETEDGUESTANDTHEBACKUPCATALOGUE § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORAVMEXAMIN AT ION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The VM evidence checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Is a copied VM as good as imaging the original server? Someone reverted the machine to an old snapshot. Is the interval gone? A VM was deleted before we could act. What are the odds? Can we make the other side disclose hypervisor logs and backup catalogues? The disputed VM runs in Azure/AWS, not on our opponent's own servers. Does the approach change? We suspect an employee ran a hidden VM on their laptop. What should we ask for? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY