Skip to content

Phil Hagen's Scratch Pad

Writings, Postings, Droppings…

Tag: vmware

VMware Snapshot Forensics

I recently determined the format for timestamps indicating when VMware Snapshots were initially created, as logged in the *.vmsd file.

Published March 20, 2013
Categorized as Computer Forensics Tagged forensic, python, snapshots, tips, vmware

Recent Posts

  • CDN, TLS, and WordPress – Oh My!
  • Logstash: BFD (Big Forensic Data)
  • Slides from SANS @Night, Bangalore India
  • iptables Processing Flowchart (Updated Often)
  • Slides from SANS @Night: There’s GOLD in Them Thar Package Management Databases
  • Twitter:
    Follow @PhilHagen
Phil Hagen's Scratch Pad
Proudly powered by WordPress.