0

I am currently in the middle of operating an analysis on Autopsy of a virtual machine (VMware) that has been hacked. I have mounted the VM and I am acquiring the evidence from VMware to my physical machine (Windows 10).

I am trying to do a Logical File Acquisition of certain files and folders ;

  • Windows Event Viewer Logs (Application, System, Security) OpenSSH Logs
  • Registry Keys
  • NTUSER.DAT
  • system32/config/SAM

However, file permissions Windows have installed is making it difficult for me to get hold of any of this. I don’t want to run a full physical as I’m only after certain artefacts.

Any recommendations would be appreciated greatly

C.Mann
  • 73
  • 7

1 Answers1

1

Well first and foremost, you've already screwed up by mounting the VM which will have written to it as a side affect of mounting. Hopefully this is a copy?

Second, acquiring a logical copy is always a mistake if you don't have to due to constraints that prevent a physical copy.

All of your problems go away with a physical acquisition. Even though it's a VM you can still do a physical acquisition and it's dirt simple:

1. Run Autopsy

2. Target the VM .vmdk as the acquisition.

Done!

If you're still determined to do a selected logical acquisition, it's easiest to pull the target files via Linux.

user10216038
  • 7,552
  • 2
  • 16
  • 19