I would prefer a physical machine because you are able to dedicate more resources to the processing of data instead of running the virtual machine that will limit the amount of RAM, processors and hard drive space for analyzing a disc image. If you don't have the money to dedicate an entire machine to forensics, then Virtual machine is the alternative. But I would still highly recommend a solid physical computer with good specs to be able to handle a lot of data processing and analysis.
↧