Computer Forensics JumpStart, Second Edition

Working with Virtual Machines

A virtual machine (VM) is a software application that acts like a computer and runs its own self-contained operating system, complete with applications inside the physical host machine. A single host machine can support one or more guest virtual machines at the same time, on different operating systems.

If you’re in the forensic investigation business long enough, you’re going to end up working with virtual machines sooner or later. As the use of virtual machines on personal computers grows, forensic investigators are more likely to find virtual machines as the subject of an investigation. In addition to being the subject of an investigation, virtual machines can be a benefit to the forensic investigator and you ...