Every forensics material you read, tell you to get an image of the disk and work with this image. However, it seems they always refer to a single computer.

What if the compromise is on a VMWare installation where there are multiple disks setting up LUNs and LUN groups? How should I get the image?

1 Answer 1


You shouldn't get the image, they are already there on your vmware repos. You need only investigate them.

It is best possible if you set up (or use a soon created) virtual machine. So:

  1. stop the comporomised VMs
  2. get away their disks
  3. give them to your investigating/service VM
  4. check everything from it.

Luns haven't anything with them to do, they are only part of the virtual SCSI emulation of the vmware. They doesn't really matter, what really matters are the disk images on your system.

There is also a possibility, if you need to investigate a whole vmware system. In this case, the things are a little bit complexer, although I don't think that a vmware server could be really corrupted.

In this case I handled the vmware physical disks as normal disks (so I copied an image from them), extracted the .vmdk images from them, and used them. So, the image creation has a two-stage process:

  1. extract the vmware .vmdk disks from the vmware repos,
  2. analyse their content.

Here can a little trouble come in the picture, and this is that vmware uses vmfs filesystem for the vmdk images. But this vmfs can be processed by tools freely downloaddable from vmware.com.

You must log in to answer this question.