Recovering virtual machines from lost VMFS partitions (W29)

Product Description

The access to this course is restricted to eForensics Premium or IT Pack Premium Subscription

---

In this course you will learn how to recover virtual machines from lost VMFS partitions from the Linux operating system environment. Whether for forensic investigations, incident response, or simply data recovery, this workshop will add one more tool to your arsenal. To make sure you come out with a new skill in hand, the course includes a practical workshop simulating a forensics investigation, in which you will be asked to perform data recovery and provide a report on your findings. 

---

Course duration: 4 hours (4 CPE points)

Pre-recorded, Self-paced

---

---

Want a sample? Watch this video from the course on how to mount images in RAW format using the losetup command: https://eforensicsmag.com/mounting-forensic-images-using-losetup-cli-free-course-content/ 

---

What will you learn?

You will learn how to use the dcfldd command line for disk/volume image generation. You will use the losetup utility in conjunction with fdisk to evaluate the partition information expected to be recovered/mounted. You will also learn how to install and use the vmfs-tools package to manage the lost/hidden partitions.

---

What skills will you gain?

• You will learn about the importance of making use of RAW images for data recovery activities;
• Ability to use dcfldd, losetup and vmfs-tools;
• Ability to identify and manage VMFS partitions (Core partition/VM partition), even though the partition is not identified.

---

What will you need?

• Basic concepts of the Linux operating environment;
• Basic concepts on RAW Images;
• A small volume 2.0Gb drive just for exercising RAW imaging.

---

What should you know before you join?

• Basic concepts of the Linux operating environment;
• Basic concepts on RAW Images;
• Basic understanding of VMware environment.

---

Note: since this class was published in 2017, some technologies have advanced and tools had new versions released. These materials have not been updated, however the concepts and techniques presented remain largely relevant.  

---

Your instructor: Washington  Almeida

Washington Almeida is a Forensic specialist with academic background in Electronic Engineering and Information Technology. Specialized in Digital Forensics and Cyber Security with more than twenty five years of experience, familiar with digital forensic procedures that comprises digital forensics investigations phases as collection, examination, analysis and reporting, assisting justice in cases involving social media environment, instant messaging, droppers, ransomware, intellectual property rights infringement, e-mails system, HR systems, databases, data theft, bank fraud, computer hacking, Internet applications among others. MCSE Microsoft Certified consistently updated and maintaining an excellent understanding of the Microsoft Windows environment, Internet applications and Linux/Unix platforms which makes him comfortable when it comes to technical details.

Instructor curriculum: http://www.washingtonalmeida.com.br/curriculum.html

---

Syllabus

---

The course consists of a single module that provides covered topics listed below. For more - check out the Curriculum.

Covered Topics:

• Differences between cloning and imaging;
• Why cloning/imaging is important;
• Using dcfldd command line;
• Using hash function;
• Using losetup;
• Using fdisk on loop devices;
• Installing vmfs-tools from Linux repository;
• Cloning vmfs-tools from Github repository;
• Using vmfs-fuse

Practical exercises:

• RAW image creation;
• Check hashes from source data and image file;
• Recover VMFS partitions.

---

Course format: 

• The course is self-paced – you can visit the training whenever you want and your content will be there.
• Once you’re in, you keep access forever, even when you finish the course.
• There are no deadlines, except for the ones you set for yourself.
• We designed the course so that a diligent student will need about 18 hours of work to complete the training.
• The course contains video and text materials, accompanied by practical labs and exercises.

---

---

Contact:

If you have any questions, please contact us at [email protected].