Digital Forensics Lab: Detecting VMware Workstation Player Evidence with OSForensics

In this digital forensics lab, we walk through how to detect evidence of VMware Workstation Player on a host system using OSForensics. This activity shows how to create a forensic case, open and analyze the Windows SOFTWARE registry hive, locate VMware-related registry entries, review VMware driver artifacts, and export the registry key data for documentation and analysis. This is a great hands-on exercise for students learning registry forensics, virtualization artifact detection, and host-based forensic analysis. It also helps demonstrate how investigators can identify traces of virtual machine software on a live or imaged Windows system and begin building a forensic trail that could later support locating and acquiring the virtual machine files themselves. Disclaimer: This video is for educational purposes only. This lab is based on material from Guide to Computer Forensics and Investigations, 7th Edition — Cengage. The material is used here for instructional and academic discussion. All credit for the original source material belongs to the respective author(s) and publisher. This video is intended only to support authorized learning in digital forensics and cybersecurity education.