The forensic effectiveness of virtual disk sanitization

Abstract

It is a very likely situation for a digital forensics investigator to encounter a virtual machine during an investigation. The evidence found in a vmdk disk may not necessarily belong to the virtual machine. It is possible that a vmdk disk could contain previously deleted data from the host machine. In this paper we investigate the possibility of type 1 and type 2 hypervisor virtual disks to contain previously deleted data from the host machine. We specifically tested VMware Workstation 11 and ESXi vSphere 6.0 products for each type respectively. We also attempt to identify the disk sanitization strategies employed by these products, and locations within a virtual disk that could potentially contain unallocated host data.