Structural Analysis of VMware Virtual Disk and its Application in Electronic Data Examination

Chinese Journal of Forensic Sciences ›› 2011 ›› Issue (2): 60-64.

Previous Articles Next Articles

Structural Analysis of VMware Virtual Disk and its Application in Electronic Data Examination

QIAN Wei， SHA Jing

Shanghai Stars Digital Forensic Center， Key Laboratory of Information Network Security， Ministry of Public Security， Shanghai 200035， China

Received:2009-08-06 Published:2011-03-15 Online:2022-07-25

VMware虚拟磁盘结构分析及在电子数据取证中的应用

钱伟，沙晶

上海辰星电子数据司法鉴定中心公安部第三研究所信息网络安全公安部重点实验室，上海200035

作者简介:钱伟（1984-），男，助理工程师，硕士研究生，主要从事网络攻防虚拟技术研究。

Abstract

Abstract:

This paper gave a detailed structural analysis of VMware virtual disk and corresponding solutions to problems emerged in electronic data examination， like virtual disk image loading， data migration of virtual machines， files search on virtual disk， examination and restoration of virtual disk data.

Key words: virtual machine, disk, electronic data, electronic evidence

摘要： 详细分析了VMware的虚拟磁盘结构，并针对电子数据取证中的磁盘镜像虚拟加载、虚拟机数据迁移、虚拟磁盘文件的搜索和虚拟磁盘数据的鉴定与恢复等实际问题提出相应的解决方案。

关键词: 虚拟机, 磁盘, 电子数据, 取证

CLC Number:

TP393

QIAN Wei, SHA Jing. Structural Analysis of VMware Virtual Disk and its Application in Electronic Data Examination [J]. Chinese Journal of Forensic Sciences, 2011(2): 60-64.

钱伟, 沙晶. VMware虚拟磁盘结构分析及在电子数据取证中的应用 [J]. 中国司法鉴定, 2011(2): 60-64.

[1]	LIU Haoyang, YANG Xiulei. The Current Situation and Challenges of Electronic Data Forensic Appraisal in Public Security Organs [J]. Chinese Journal of Forensic Sciences, 2022, 120(1): 54-59.
[2]	SUN Yi, LI Yan, SHEN Changda, GUO Hong, HUANG Zhiwei, MAO Xiao, LI Zhijun. Exploring the Practice of Forensic Appraisal of Automotive Electronic Data [J]. Chinese Journal of Forensic Sciences, 2022, 120(1): 45-53.
[3]	GUO Hong, YANG Kai, GENG Puyang, LI Yan, LU Qimeng, LING Rong, JIA Rujing. Design and Analysis of Proficiency Testing in the Field of Forensic Appraisal of Electronic Data—Taking the Functional Appraisal of Electronic Data in 2021 as an Example [J]. Chinese Journal of Forensic Sciences, 2022, 120(1): 38-44.
[4]	. On the Electronic Evidence in Criminal Procedure [J]. , 2013, 67(2): 80-86.
[5]	CHANG Bin. The Electronic Data Examination in an Economic Dispute Case [J]. Chinese Journal of Forensic Sciences, 2012, 63(4): 100-103.
[6]	DU Zhi-chun, LIAO Gen-wei. Comparative Analysis of the Concepts of Digital Evidence， Electronic Evidence， Scientific Evidence and Electronic Records [J]. Chinese Journal of Forensic Sciences, 2011, 57(4): 64-68.
[7]	HUANG Bu-Gen. Techniques of Password Decryption [J]. Chinese Journal of Forensic Sciences, 2010, 53(6): 33-46.
[8]	GUO Qiu-xiang;ZHU Jin-yi(.Shandong Computer Forensic Institute;Shandong Computer Centre;Jinan 00;China;.Shandong Public Security Bureau;Jinan 000;China). The Construction of the Electronic Data Examination System [J]. , 2010, 0(02): 57-60.
[9]	YIN Dan (Laboratory of Digital Forensics;the First Research Institute of Ministry of Public Security;Beijing 000;China). The Application of X-Ways Forensics in Digital Forensics [J]. , 2009, 0(05): 73-75.
[10]	HUANG Bu-gen;HUANG Zheng;ZHAO Bing(.Department of Forensic Science;Jiangsu Police Institute;Nanjing 00;China;.Department of Network Security;Nanjing Municipal Public Security Bureau;Nanjing 000;China). Two Methods for Identifying the Origin of Trojan Code [J]. , 2009, 0(03): 79-82.
[11]	YU Wen-liang;LI Zheng-xiang;WANG Yue-cong (. Shenzhen Public Security Bureau;Shenzhen 00;. Fujian ZhongZheng Judical Identification Center;Xiamen 00;China). Emergency Methods for Electronic evidence fixing [J]. , 2009, 0(01): 57-60.

Structural Analysis of VMware Virtual Disk and its Application in Electronic Data Examination

VMware虚拟磁盘结构分析及在电子数据取证中的应用

PDF

Knowledge

Cited

Abstract

Cite this article

share this article

References

Related Articles 11

Recommended Articles

Metrics