VMware Config
Overview
Section titled “Overview”Evidence: VMware Config
Description: Collect VMware Config
Category: Applications
Platform: windows
Short Name: vmc
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”VMware Workstation stores configuration files including recent virtual machine lists (VMLS files) and settings (INI files). These files track which VMs were accessed and user preferences.
Data Collected
Section titled “Data Collected”This collector gathers structured data about vmware config.
Collection Method
Section titled “Collection Method”This collector gathers VMware VMLS and INI configuration files from the Roaming profile containing VM access history and settings.
Forensic Value
Section titled “Forensic Value”VMware config files reveal which virtual machines were run, their locations, and usage patterns. This helps identify VMs used for testing malware, accessing isolated environments, or hiding activities.