7. Finding and Imaging Virtual Environments

INFORMATION IN THIS CHAPTER Detecting Rogue Virtual Machines Is It Real or Is It Memorex? Imaging Virtual Machines Snapshots VMotion Identification and Conversion Tools Environment to Environment Conversion

As an investigator, especially in a live environment, it may be necessary to find and image rogue virtual machines (VMs). Additionally, there may be the need to acquire virtual machine snapshots and use conversion tools. The investigator may have to determine if the environment is indeed physical or virtual. More importantly, the investigator may have to testify to the type of environment examined in court.