First Response & Preservation Technical Explainer

Could a virtual machine be running?¶

Yes. One physical computer can run another complete operating system inside a virtual machine. The host and guest have separate users, processes, files, clocks, memory and network activity, even though they share physical hardware.

A window labelled Hyper-V, VMware, VirtualBox or Parallels may therefore be the console for another live computer, not merely an ordinary application.

Think in layers¶

The host and guest are related but distinct evidence sources

Physical hostComputer and host operating systemMay hold virtualisation logs, configuration, virtual disks and host network records.

Virtualisation layerHyper-V, VMware or another platformDefines the guest, its state, devices, checkpoints and virtual network.

Guest systemSeparate running operating systemHas its own accounts, applications, memory, files and event records.

External storage or serviceVirtual disk, share or cloud hostThe data may sit somewhere other than the physical computer in front of you.

Preserving the physical host alone does not automatically explain the live guest state or where its virtual storage is held.

In Hyper-V, for example, management information can identify a virtual machine by name and state such as Running. Saving a virtual machine is an action comparable to hibernating a physical computer; it is not a neutral observation.

Current Microsoft Hyper-V behaviour - checked 27 September 2026

For Windows Server 2025, Microsoft documents that Get-VM retrieves virtual machines from one or more Hyper-V hosts and can return machines whose state is Running. Microsoft describes Save-VM as saving a virtual machine, similar to hibernating a physical computer. Other virtualisation products may use different state names and behaviours.

Record the relationship before changing it¶

Capture what is already visible:

virtualisation product and host name;
virtual-machine name and identifier;
running, paused, saved, suspended or off state;
guest console, operating system and logged-in account;
virtual disks and storage locations;
virtual network and connected interfaces;
checkpoints or snapshots shown; and
displayed time on both host and guest.

The virtual disk may be local, on removable media, on a server or on a cloud platform. The guest's network address may also differ from the host's. Those details identify where later acquisition and log enquiries need to go.

Avoid creating a new virtual state¶

Closing the console may only hide the guest, or it may prompt to save, suspend, shut down or power it off. Pausing, saving, checkpointing and shutting down each create a different change to memory, storage and platform records.

Seek specialist advice before selecting one. A virtual-machine name or guest account can connect technical activity to that environment; it does not by itself identify the person who operated it.

If the relevant workload or session may sit beyond the guest or physical host, continue to containers and remote desktops.