摘要： 介绍VMware Workstation软件常见的虚拟机磁盘文件结构及其含义，提出一种符合司法要求的虚拟机文件取证方法。通过直接扫描虚拟机文件，依据虚拟硬盘分区文件类型的存储结构定位虚拟机磁盘文件的虚拟主机的相应扇区，获取证据。以虚拟硬盘分区文件系统NTFS为例进行说明，探讨在虚拟机下进行计算机取证的策略。
关键词:
虚拟机,
VMware Workstation软件,
取证
Abstract: This paper introduces the structure and meanings of virtual machine disk file under VMware Workstation software. And the approach for the virtual machine files for judicial need is analyzed. According to the file storage structure in the partition file system, it scans the virtual machine file to locate the sector in the virtual host of the virtual machine disk file for accessing to evidence. Taking virtual hard disk partition to NTFS file system as an example, it discusses some forensic strategies under a virtual machine.
Key words:
virtual machine,
VMware Workstation software,
forensic
中图分类号:
钟 琳;许榕生. 虚拟机文件取证分析[J]. 计算机工程, 2010, 36(8): 76-79.
ZHONG Lin; XU Rong-sheng. Analysis of Virtual Machine File Forensic[J]. Computer Engineering, 2010, 36(8): 76-79.