Evidence: VMware Config
Description: Collect VMware Config
Category: Applications
Platform: windows
Short Name: vmc
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
VMware Workstation stores configuration files including recent virtual machine lists (VMLS files) and settings (INI files). These files track which VMs were accessed and user preferences.
Data Collected
This collector gathers structured data about vmware config.
Collection Method
This collector gathers VMware VMLS and INI configuration files from the Roaming profile containing VM access history and settings.
Forensic Value
VMware config files reveal which virtual machines were run, their locations, and usage patterns. This helps identify VMs used for testing malware, accessing isolated environments, or hiding activities.
