摘要
介绍VMware Workstation软件常见的虚拟机磁盘文件结构及其含义,提出一种符合司法要求的虚拟机文件取证方法。通过直接扫描虚拟机文件,依据虚拟硬盘分区文件类型的存储结构定位虚拟机磁盘文件的虚拟主机的相应扇区,获取证据。以虚拟硬盘分区文件系统NTFS为例进行说明,探讨在虚拟机下进行计算机取证的策略。
This paper introduces the structure and meanings of virtual machine disk file under VMware Workstation software.And the approach for the virtual machine files for judicial need is analyzed.According to the file storage structure in the partition file system,it scans the virtual machine file to locate the sector in the virtual host of the virtual machine disk file for accessing to evidence.Taking virtual hard disk partition to NTFS file system as an example,it discusses some forensic strategies under a virtual machine.
出处
《计算机工程》
CAS
CSCD
北大核心
2010年第8期76-78,82,共4页
Computer Engineering
基金
北京市优秀人才培养基金资助项目(20061D0500700165)
北京市教委科技发展计划基金资助项目(KM200610772006)
