VMware Config

Overview

Evidence: VMware Config Description: Collect VMware Config Category: Applications Platform: windows Short Name: vmc Is Parsed: No Sent to Investigation Hub: No Collect File(s): Yes

Background

VMware Workstation stores configuration files including recent virtual machine lists (VMLS files) and settings (INI files). These files track which VMs were accessed and user preferences.

Data Collected

This collector gathers structured data about vmware config.

Collection Method

This collector gathers VMware VMLS and INI configuration files from the Roaming profile containing VM access history and settings.

Forensic Value

VMware config files reveal which virtual machines were run, their locations, and usage patterns. This helps identify VMs used for testing malware, accessing isolated environments, or hiding activities.