NetworkNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.Virtual Machine / Hypervisor Forensics
Examine VMDK, VHDX and QCOW2 disks, snapshots, ESXi logs and VM memory files.
- Advanced
- Online or on campus
- 4 hands-on labs
- 6 modules
About this course
Most company servers now run as virtual machines. When ransomware hits a data centre, the attacker often goes after the hypervisor itself and encrypts every virtual disk on it in one go. Investigating that needs a different approach from imaging a single laptop.
In this course you learn how virtual disks are built and how to open them without changing them. You work with VMware VMDK files, Hyper-V VHD and VHDX files and QCOW2 images from KVM and QEMU. Snapshots get special attention because each one is a record of the machine at an earlier point in time, sometimes from before the attack.
You also study the hypervisor as evidence. VMware ESXi keeps its own logs of logins, shell use and VM operations. A suspended or snapshotted VM leaves its RAM on disk as a .vmem file, which you can analyse with Volatility 3 just like a memory dump taken from a live machine.
VMDK, VHDX, QCOW2SnapshotsVMware ESXi logsVM memory
After this course you can
- Identify VMDK, VHD, VHDX and QCOW2 formats and their descriptor, extent and differencing files
- Acquire and mount virtual disks read-only and verify them by hash
- Use snapshot chains to see the state of a machine at different points in time
- Read VMware ESXi host logs to trace logins, SSH and shell use and VM power or delete actions
- Analyse VM memory from .vmem and Hyper-V saved state files
- Plan evidence collection from a running virtual environment with the least disturbance
Syllabus
6 modules · 23 topics
01Virtualisation for investigators3 topics
- Type 1 and Type 2 hypervisors: ESXi, Hyper-V, KVM, VMware Workstation and VirtualBox
- What a VM is on disk: configuration, disks, memory and logs
- VMFS datastores, vCenter and where evidence sits in a cluster
02Virtual disk formats4 topics
- VMDK descriptor files, flat and sparse extents
- VHD and VHDX, and AVHDX differencing disks in Hyper-V
- QCOW2 images and backing files in KVM and QEMU
- Converting formats with qemu-img and when you should not
03Acquisition and mounting4 topics
- Copying VM files from a datastore and hashing them
- Opening virtual disks in FTK Imager, Autopsy and X-Ways Forensics
- Mounting read-only with Arsenal Image Mounter
- Live collection when the VM cannot be shut down
04Snapshots and time4 topics
- How snapshot chains work: -000001.vmdk delta files and .vmsn files
- Hyper-V checkpoints and their files
- Rebuilding the disk as it was at each snapshot
- Comparing snapshots to find what changed
05Hypervisor logs4 topics
- ESXi logs: hostd.log, vmkernel.log, auth.log and shell.log
- The vmware.log file kept with each VM
- Hyper-V event logs on the host
- Signs of attacks on ESXi, such as SSH turned on and VMs powered off in bulk before encryption
06Memory from virtual machines4 topics
- The .vmem file and its .vmss or .vmsn companion
- Hyper-V saved state files (.vmrs) and converting them to a dump before analysis
- Analysing VM memory with Volatility 3
- Pausing a VM to capture memory compared with running a tool inside it
Hands-on labs
- Lab 1
Acquire a VMware VM from a datastore, verify hashes and open its VMDK in Autopsy
- Lab 2
Walk a three-level snapshot chain and recover a file deleted after the second snapshot
- Lab 3
Trace an attacker's SSH login and VM shutdown commands through ESXi logs
- Lab 4
Extract running processes and network connections from a .vmem file with Volatility 3
Tools you will use
- FTK Imager
- Autopsy
- X-Ways Forensics
- Arsenal Image Mounter
- qemu-img
- Volatility 3
Who it suits
- Forensic examiners who already image physical disks
- Incident responders handling server and data centre breaches
- System administrators who run VMware or Hyper-V
- Lab staff who receive VM files as exhibits
Before you join
- Disk imaging and file system basics, such as HDD Forensics or File System Analysis
- Some hands-on use of VMware, Hyper-V or VirtualBox
- Memory Forensics is useful for the last module but not required
Questions about this course
Can I treat a VMDK file like a normal disk image?
Often yes, once it is opened correctly. Most forensic tools read VMDK and VHD files directly. Snapshots and split extents need care, because opening the wrong file in the chain shows you an older or incomplete disk.
Is VirtualBox covered?
Yes, as a Type 2 hypervisor you may meet on a suspect's laptop. The main focus is on VMware ESXi and Hyper-V because those run most company servers.
Why is this an advanced course?
It builds on disk imaging, file systems and some memory analysis. If you are new to forensics, start with the storage or foundation courses first.
More courses in Network & Cloud Forensics
NetworkNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.
NetworkWireshark / Packet CaptureCapture, filter and read packets in Wireshark and tshark to recover what was sent.
NetworkCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.Not sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.