Virtual Machine Forensic Analysis And Recovery Method For Recovery And Analysis Digital Evidence

Abstract”” Virtual machine has been the most one of virtualization technology used today for working and saving hardware resources, besides as a tool conduct research on malware, network installations etc. The wide use of virtualization technology is becoming a new challenge for digital forensics experts to carry out further research on the recovery of evidence of deleted virtual machine image. This research tries to find out whether there is evidence of generated activity in the destroyed virtual vachine and how to find the potential of digital evidence by using the Virtual Machine Forensic Analysis and Recovery method. The result showed, the virtual machine which was removed from the VirtualBox library could be recovered and analyzed by using autopsy tools and FTK with analytical method, 4 deleted files in the VMDK file could be recovered and analyzed against the digital evidence after checking the hash and metadata in accordance with the original. However, Virtual machine image with Windows-based and Linux-based operating systems which was deleted using the destroy method on VirtualBox could not be recovered by using autopsy and FTK, even though VirtualBox log analysis, deleted filesystem analysis, and registry analysis to recover backbox.vmdk and windows 7.vmdk does not work, due to the deletion was done using a high-level removal method, almost similar to the method of wipe removal of data on the hard drive.