Breaking Encrypted Virtual Machines: Recovering VMWare, Parallels, and VirtualBox Passwords

Virtual machines use a portable, hardware-independent environment to perform essentially the same role as an actual computer. Activities performed under the virtual umbrella leave trails mostly in the VM image files and not on the host computer. The ability to analyze virtual machines becomes essential when performing digital investigations.

Many types of virtual machines used in the criminal world feature secure encryption. Evidence stored in encrypted VM images can be only accessed if one can produce the original encryption password. We built a tool to enable experts run hardware-accelerated distributed attacks on passwords protecting encrypted VM images created by VMWare, Parallels, and VirtualBox.

👉 https://blog.elcomsoft.com/2020/10/breaking-encrypted-virtual-machines-recovering-vmware-parallels-and-virtualbox-passwords/

#vmware #virtualmachines #dfir #virtualbox #parallels #passwords