Posts on Forensicating Ninja

Acquiring evidence from VMWare ESXI datastores

Sat, 15 Dec 2018 00:00:00 +0100

When acquiring evidence from ESXI environments you can encounter different types of datastores on which the VMs live:

Internal datastore
External iSCSI datastore
External NFS datastore

Types of datastores

Internal datastore

This type of datastore is only accessible on the ESXI server itself. In order to access it externally you should first enable remote SSH access on the ESXI server. With the SSH access you can now mount the internal datastore with SSHFS (you might have to install it first):

Enabling VMWare HGFS The systemd way

Sat, 15 Dec 2018 00:00:00 +0100

Sometimes when setting up a new Linux VM the shared folder functionality HGFS (Host-Guest Filesystem) does not work after installing the package “open-vm-tools-desktop”. This happened to me in Fedora 29 recently.

To fix the issue you can add a systemd service which will automount all available shares. Add this script to “/etc/systemd/system/vmhgfs.service”:

[Unit]
After=network.target
Description=VMWare HGFS automounting

[Service]
ExecStart=/usr/bin/vmhgfs-fuse -o allow_other,auto_unmount .host:/ /mnt/hgfs

[Install]
WantedBy=multi.user.target

Now enable and start the newly made systemd service:

Enabling extra mouse buttons within VMWare Workstation

Wed, 21 Nov 2018 00:00:00 +0100

Having a functional mouse is nice, but what if you can’t use any of the extra buttons in your VM.

The problem is that VMWare Workstation only passes the most basic buttons (left, right and middle) to your VM. This might be OK when working on a touchpad but when you throw some money on a decent mouse (Logitech MX Master or whatever) it will make you scream.

To pass more buttons to your VM, add the following to your .VMX file: