VM Forensics

In our test/dev lab we are running vSPhere 6.0, 6.5 and 6.7 on different platforms.

We are looking into how to perform forensics on VMs (OVFs, Snapshots, etc.) off line.

Does anyone know of any products in the VMware portfolio or partner products that may be a good option for this use case?
LVL 1
Stan NovinskyVirtualization Engineer Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

David Johnson, CDRetiredCommented:
Forensics on a virtual disk is exactly the same as with a physical disk.
serialbandCommented:
It's actually a bit easier since it's already a file that you can more easily "clone" and back up without having to pull out disks.
Stan NovinskyVirtualization Engineer Author Commented:
thanks,,,can you provide examples or tools on the best approach to do the forensics
OWASP: Avoiding Hacker Tricks

Learn to build secure applications from the mindset of the hacker and avoid being exploited.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
pma111Commented:
Encase and FTK are common.
Stan NovinskyVirtualization Engineer Author Commented:
thanks for these tips....

We use Veeam and have VAS.

The Enterprise and Enterprise Plus options provide a tool called DataLabs (sandbox) that also may be used in conjunction with tools
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Digital Forensics

From novice to tech pro — start learning today.