Could a virtual machine be running?¶

Yes. A computer may be running one or more virtual machines that contain separate operating systems, applications and evidence.

Why this matters¶

The dangerous assumption is that the visible host computer contains all relevant activity. A virtual machine may hold different accounts, files, network connections, logs and running processes.

What to record and do¶

Record any virtualisation application, virtual-machine name, console window, status indicator, snapshot notice or guest operating system visible on screen.

Capture whether the virtual machine appears running, paused, suspended or shut down.

Do not close the virtualisation software, pause the machine or switch between guests merely to explore.

A virtual machine may contain unsaved data, active sessions or memory-resident evidence that is lost if it is stopped.

Its virtual disks may be stored locally, on external storage, on a server or in cloud infrastructure.

The host and guest systems may have different clocks, users, network addresses and evidential states.

Where virtualisation is suspected, seek specialist support before power, shutdown or acquisition decisions.

Record the relationship between the host computer, the visible virtual machine and any connected storage or remote platform.

Do not assume that the named virtual machine belongs to or was used by the person present.

A suspended or paused machine may preserve some state, but changing that state can still alter evidence. Record visible storage locations, virtual network names and whether snapshots or checkpoints are shown before any specialist action.

Operational takeaway¶

Treat a running virtual machine as a separate live evidential system and avoid pausing, closing or switching it without specialist assessment.