I have to archive (and in some cases analyse) malicious files that were able to get in our company. What precautions should one take for handling these files? Given that the files won´t be executed (this happens in a seperate environment) but are just stored and get opend in i.e. Notepad++, is a Virtual Machine really necessary?
Not using a VM will leave you totally dependent on the static analysis programs and any other program (hex editor, text editors and so on) you use. This is dangerous. In my opinion, too dangerous. Like Matthew said, any bug in, say notepad++, will put your archiving machine at risk of being attacked when all you think you are doing is analyzing the file.
Furthermore, a VM will be much easier to repair in case of a malicious program wreaking havoc. With snapshots you can easily undo any damages.