Digital Forensics: Virtual Machine and Cloud Forensic Scenarios

FACT Digital Forensics paper drill on applied virtual machine and cloud forensic scenarios, sitting one level above the introductory definitions mock on the same syllabus. Questions place the candidate inside a specific case and ask which technique applies: choosing between live and offline acquisition for a fileless guest, picking the right VMware artefact (.vmem at a snapshot, .vmss at a suspend, .vmsn for metadata), mounting VMDK chains and Hyper-V .avhdx differencing disks as ordered overlays, converting QCOW2 to raw with qemu-img convert, reading vmware.log for VM escape signals, inspecting VMFS datastores through vmfs-tools, recognising MITRE ATT&CK T1497 anti-VM checks via CPUID and MAC OUI, walking the Docker OverlayFS layer stack, retaining Kubernetes emptyDir evidence by shipping logs, acquiring vSAN through the API rather than by pulling drives, and choosing in-guest tools such as LiME or AVML for live memory. The cloud half tests log-source selection between CloudTrail, VPC Flow Logs, CloudWatch Logs, and S3 access logs, the iam:CreateAccessKey to iam:AttachUserPolicy escalation chain under MITRE T1098, the volatile-first acquisition order paired with EBS snapshot copy across accounts and regions, multi-tenancy under NIST IR 8006, KMS misuse evidence (key policy, grants, last-used), least-privilege failures in IAM JSON, the interaction of CLOUD Act 2018, IT Rules 2021, and DPDP Act 2023, MLAT preservation requests, Lambda forensics through CloudWatch Logs only, Azure Diagnostic Settings for Resource Logs, GCP Cloud Audit Logs Admin Activity vs Data Access, CloudTrail digest-chain tampering indicators, and S3 Object Lock compliance mode plus MFA Delete for legal hold.

For FACT digital-forensics aspirants and MSc students working through applied virtualisation and cloud incident-response scenarios, useful as a revision pass before NFSU MSc, GCFA, SANS FOR509, CCSP, and AWS Security Specialty exams. Questions emphasise picking the right technique under a specific scenario rather than reciting definitions, with Indian and US legal anchors for cross-border cloud cases.

Topics covered:

• Live vs offline VM acquisition for fileless and snapshot scenarios
• VMware .vmem, .vmss, .vmsn, .vmx, VMDK chains and ESXi VMFS datastores
• Hyper-V .avhdx checkpoint chains and VirtualBox .vbox and .vdi files
• QCOW2 to raw conversion with qemu-img and qemu-nbd cross-format mounting
• Container OverlayFS layers and Kubernetes emptyDir evidence retention
• AWS log-source selection: CloudTrail, VPC Flow Logs, CloudWatch, S3 access logs
• IAM escalation chains, KMS audit, least-privilege failures, MITRE T1098 and T1497
• EBS snapshot acquisition order and cross-region cross-account chain-of-custody
• CLOUD Act 2018, IT Rules 2021, DPDP Act 2023, MLAT preservation requests
• Lambda, Azure Resource Logs, GCP Audit Log streams, CloudTrail integrity, S3 Object Lock

Useful for revision and self-testing before the FACT Digital Forensics paper.

Allow 30 minutes.