Title: 8. Understanding Virtual Machines
Course: IN 2005 Digital Forensics > Section: Module 6: Chapter 6 - Working with Windows and DOS Systems

Understanding Virtual Machines

1. A virtual machine allows you to create a representation of another computer on an existing physical computer.  A virtual machine is just a few files on your hard drive.  You do have to allocate space to it.  See Figure 6-19.
2. A virtual machine recognizes components of the physical machine it’s loaded on.  The virtual OS is limited by the physical machine’s OS.
3. In computer forensics, virtual machines make it possible to restore a suspect drive on your virtual machine and run nonstandard software the suspect might have loaded.
4. From a network forensics standpoint, you need to be aware of some potential issues, such as a virtual machine used to attack another system or network.

Creating a Virtual Machine

1. Two popular applications for creating virtual machines are VMware and Microsoft Virtual PC.
2. See Figures 6-20 through 6-22 that describe how to create a new virtual machine with Virtual PC. Mention that you need an ISO image of an OS because no OSs are provided with Virtual PC.
3. Virtual PC creates two files for each virtual machine: a .vhd file, which is the actual virtual hard disk and a .vmc file, which keeps track of configurations you make to that disk.  See Figure 6-23.
4. To see what type of physical machine your virtual machine thinks it’s running, you should open the Virtual PC Console and click the Settings button.  See Figure 6-24.