Even More Thoughts on Forensics
Acquiring disks is a very important part of digital forensics. In my past blogs I discussed some aspects of forensics with respect to VMware ESX servers. This is the last part of the series.
To acquire a VM from a VMFS you must use a forensically sound method. One that duplicates the blocks used by the VM disk, memory, and meta files. Not a method that makes a copy. A copy is not an exact copy as file slack space (the space unused within a block) is ignored. We want this space.
There are several tools that will do this, but only one is currently available on all VMware ESX/ESXi. This is the dd tool. dd will allow you to duplicate the blocks used by the files and not just the files themselves. To copy a file or a directory you need to have some remote or USB storage available that is big enough to hold the data you want to duplicate.
Assuming a USB location that resides on device /dev/sde with a filesystem residing on /dev/sde1 mounted on /mnt/usbdevice, you can use the following to forensically copy a VMs files.
cd /vmfs/volumes/VMName; for x in `ls *.vm*`; do dd if=$x of=/mnt/usbdevice/VMName.vmdk; done
This will make a forensically sound duplicate of the files the comprise the VM. dd has many options, but will use the default blocksize of the file system from which the input file (if option) resides.
Remember to use dd to duplicate minimally the .vmdk, .vmx, .vmsn, and .vswp files.
Build your tech library with our book giveaways.
Windows PowerShell 2.0 Unleashed
By Tyson Kopczynski, Pete Handley, Marco Shaw; Published by Sams
Windows PowerShell Unleashed will not only give you deep mastery over PowerShell but also a greater understanding of the features being introduced in PowerShell 2.0–and show you how to use it to solve your challenges in your production environment. Enter now!
Ubuntu Server Administration
By Michael Jang; Published by McGraw-Hill Osborne Media
Realize a dynamic, stable, and secure Ubuntu Server environment with expert guidance, tips, and techniques from a Linux professional. Ubuntu Server Administration covers every facet of system management -- from users and file systems to performance tuning and troubleshooting. Enter now!
Hi, There appear to be a few
Hi,There appear to be a few flaws with your post.
For starters, your dd command will overwrite the output file for each of the files in the *.vm* glob, meaning you will only actually end up with the last one that matched. Perhaps you meant to put the $x somewhere in the output path also?
Secondly, I've never used ESX, but it appears that you are accessing the files on a mounted filesystem on the host (some embedded linux IIRC). So what exactly is the point of using 'dd' anyway? 'dd' in this context is ultimately reading from a logical file, not a block device. 'cp' will do exactly the same job.
Dave
I'm a user of VMWare
I'm a user of VMWare Workstation, not ESX. However, from the above command line, it appears that ESX uses .vmdk files, so simply documenting and copying the entire .vmdk file off of the system for analysis has worked very well for me during engagements. Both FTK Imager and EnCase will allow you to open the .vmdk file and acquire images, without requiring any further VMWare products.For the contents of memory, pausing a VM will create a .vmem file...this is analogous to a dd dump of RAM, and can be analyzed using the available tools.
H. Carvey
http://windowsir.blogspot.com
Hello, Re: Using cp Actually
Hello,Re: Using cp
Actually cp will not do the same job as it does not copy the underlying blocks of the file, but the content of the file. Things are slightly different there. Not if you want true 'duplication' of the underlying blocks. You can use dd to copy files as well as full devices. Unfortunately, until the spec for the VMFS is released, this is the best you can do. dd gives me the opportunity to define the size of the block as well.
Re: Workstation
ESX uses a Virtual Machine File System to store VMs unlike WorkStation. Since this is unknown to tools like EnCase and FTK, you need to use different mechanisms to get the data off the system.
Best regards
Edward L. Haletky
AstroArch Consulting, Inc.