Forensics, in terms of Information Technology, typically relates to the extraction of legal evidence from computer systems to support legal events. Forensics involves identifying, preserving, recovering, analyzing, and presenting collected data from a computer environment. Forensics is also a required component for many sensitive computing environments looking to leverage VDI solutions.
To understand how forensics is impacted by a VDI, it's first important to understand where user-authored or user-manipulated data may reside, as shown in the preceding figure.
The primary locations for user-authored or user-manipulated data are as follows:
Operating system: For VMware View solutions that do not leverage View Composer or do not leverage redirection of the user's persona, user data will reside within the operating system partition.
Persona: For VMware View solutions that leverage Microsoft roaming profiles, a persona management solution, for example, Liquidware Labs ProfileUnity TM...