Module 4 - More Network Traffic Analysis and Other Artifacts

Question 1

Name 4 artifacts worth examining related to operation of a VM

Answer 1

Logs
Memory Files
Configuration Files
Images of the computer

Question 2

VMWare Files - What Types (8)?

Answer 2

• Config Info (.vmx, .vmtm, and .vmfx)
• Config of Disk (.vmdk)
• Log Info (.log)
• BIOS state (.nvram)
• Info of suspended state VM (.vmss)
• Snapshot Info (.vmsn)
• Snapshot Metadata (.vmsd)
• Paging file or stored memory file (.vmem)

Question 3

VMWare Files - Name Important Files

Answer 3

.vmx - Configuration Information
.vmdk - Disk Configuration Information
.log - Log Information
.vmem - Paging file or stored memory file

Question 4

Name 5 Tools to Mount VMDK Disk / Workstation

Answer 4

Mount Image Pro
EnCase
VFC
LiveView
FTK

Question 5

What is VDDK?

Answer 5

VMWare’s Virtual Disk Development Kit

• set of tools to manipulate VMDK files
• direct access to virtual disk

Question 6

Indicators on system a VM was installed, run, or deleted

Answer 6

• Prefetch file
• Registry Keys (UserAssist, Installation Keys, Configuration Keys)
• Page File
• Link files
• Virtual Machine NIC adapters

Question 7

Tools to look for VM artifacts on a system

Answer 7

Scoopy Doo and Jerry (by TrapKit)

Question 8

Artifacts found on the Cloud regarding VM

Answer 8

• Cloud Mgmt system audit logs (by cloud software and OS logs of system driving management system)
• Hypervisor logs (if exist, may show migration of virtual machine and/or backups and snapshots within the cloud.
• Virtual switch logs (associate IP with a virtual machine)