Cults14 wrote:
FYI I can see no VM files in the DD image I have of the drive, a colleague (in Colorado) of our ex-worker however tells me that the user kept about a dozen VMs on an external drive which had a Dymo label on it saying "UserName VPC" - coincidence?
And we don't have the external drive <img src="images/smiles/icon_sad.gif" alt="Sad" title="Sad" />
JFYI :
Ian Fleming wrote:
Once is happenstance. Twice is coincidence. Three times is enemy actionIt seems to me like Mr. User Name left very little to chew on. <img src="images/smiles/icon_sad.gif" alt="Sad" title="Sad" />
If the Virtualbox was installed on the "C:\" drive, there may be still some traces, but this would be a "rare" case, and it would anyway need that snapshot were used. <img src="images/smiles/icon_confused.gif" alt="Confused" title="Confused" />
See:
http://programs.online.utica.edu/pdf/Neal_6_Gonnella_Forensic_Recovery_of_Evidence_from_Deleted_Oracle_VirtualBox_Virtual_Machine.pdf
but even if these were used , if they were saved on the external drive you can do nothing.
jaclaz
↧