Creating VM’s from Forensic Images for Courtroom Presentation

No ratings

Presented at TechnoSecurity&DigitalForensics 2019 by

Jeff Shackelford

One of the biggest hurdles in computer forensic testimony, is figuring out how best to approach all the technical terms, procedures and evidence that needs to be explained and presented to a “non-technical” courtroom. One of the best ways to overcome this hurdle is by providing the judge and jury with a “virtual tour” of the evidence. By harnessing forensic and VM technology, you can virtually “boot” a suspect’s computer by creating a virtual machine from your forensic image file (e.g., .E01, .DD, etc.), and viewing the system just as if you had physically brought the computer into the courtroom and powered it on. Judges and jurors can now see the system just as the suspect saw it, in its native Windows environment, and you will be able to present your evidence and findings in a much more efficient and effective way. Attendees will learn the process of creating and booting a VM of a forensic image, and how they can also use this process to locate additional evidence that’s not typically viewable via traditional forensic tools. Attendees will also learn useful tips and tricks on how to successfully introduce this in a courtroom setting.