VirtualBox is a virtualization solution for home as well as enterprise usage. It is available on Linux, macOS, and all Windows OS versions. Depending on the hardware configurations, a user can run multiple operating systems on top of the host using VirtualBox. The initial versions of VirtualBox are open-source and currently it is maintained by both open-source community and Oracle.
Installation of VirtualBox requires administrative privileges. It can spawn virtual networks, VDI and VMDK virtual drives, and supports multiple operating systems on a Windows host. Because it runs as a hypervisor, artifacts related to VirtualBox provide valuable information during forensic investigations. After analyzing VirtualBox artifacts, we can collect details about the guest operating systems run on the host, including virtual network configurations, locations of the VM hard drives, folders shared between host and guests, VM settings, and many more.
The following registry path contains VirtualBox installation details:
Global settings folder for VirtualBox is at the following location:
Default virtual machine settings are at the following directory:
This section will discuss how to use ArtiFast to extract Oracle VM VirtualBox artifacts from Windows machines and what kind of digital forensics insight we can gain from the artifacts.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select VirtualBox artifacts:
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of VirtualBox artifacts in ArtiFast.
Virtual Box General Information: This artifact contains general information about the virtual machines registered in Oracle VM VirtualBox.
Virtual Box Global Settings: This artifact contains information about the global settings and configuration for registered Virtual Machines in Oracle VM VirtualBox.
Virtual Box Leases: This artifact contains information related to VirtualBox DHCP server IP address leases.
Virtual Box Virtual Machines: This artifact contains information about the virtual machine settings.
For more information or suggestions please contact: email@example.com