VMware Workstation虚拟机镜像取证技术研究  

Research on image file forensics of VMware Workstation

作　　者：蓝朝祥 包琦 沈长达[1] 吴少华[1] Lan Chaoxiang;Bao Qi;Shen Changda;Wu Shaohua(Xiamen Meiya Pico Information Co., Ltd., FujianXiamen 361008)

机构地区：[1]厦门市美亚柏科信息股份有限公司

出　　处：《网络空间安全》2019年第4期48-54,共7页Cyberspace Security

摘　　要：云存储数据取证是电子数据取证领域的一个研究热点,虚拟机镜像文件是云存储虚拟化的一种载体。文章以VMware虚拟机镜像为研究对象,通过对镜像文件分析和比较,深入了解虚拟机镜像文件的结构组成和数据管理方式,提出一种建立数据链表、利用递归和回溯,实现读取虚拟机镜像数据的方法,解决了虚拟机镜像的读取问题,对云存储数据的提取和分析具有一定意义。Cloud storage data forensics is a research hotspot in the field of electronic data forensics. In this paper, VMware virtual machine image is taken as the research object. Through the analysis and comparison of the image files, the structure composition and data management mode of the virtual machine image files are deeply understood. A method is proposed to establish a data linked list, which uses recursion and backtracking, and realizes the reading of the virtual machine image data. It solves the problem of reading virtual machine images and has great significance for the extraction and analysis of cloud storage data.

关 键 词：VMwareWorkstation 虚拟机镜像 电子取证 

分 类 号：TP915.08[自动化与计算机技术]