A Discussion on the Recovery of Data from a Virtual Machine

This paper aims to provide an initial point of reference for future research within the field of recovering files from virtual machines. We discuss the current methods of file recovery from a physical machine, we define virtualization, and expand on how virtual machines differ from physical machines. We present a brief scenario that involves the use of a virtual machine in a cyber crime. We build upon that on the potential issues faced that could be faced by a forensic investigator. We then conclude with recommendations of future research in the field, aiming to address the issue of recovering files from a virtual machine.