Practice of downloading the operating system on digital media in virtual machine environment

The correctness of the conclusion of the conducted research is best verified by repeated research and comparison of the obtained results. In forensic research, there is a very large percentage of research types in which the use of destructive research methods is necessary. Computer-based expertise differs from many other types of research by having a minimal number of methods that lead to the destruction or alteration of the information content of the material evidence after the study. When researching information carriers, the performer (expert) is given a unique opportunity to copy all information content of the information storage to his workstation for further research. This opens up the possibility of self-control – copying information content and applying software to it can be done several times, which can confirm the correctness of the conclusion. Forensic experts do not physically encounter the owner of the media provided for the research in the practice of computer-technical expertise, but in the course of the research of the information content, unintentionally they get some idea about the person (psychological portrait) who has been engaged in filling this information content, especially when a storage medium contains an operating system. A lot of information about its user is stored in the operating system and in the application software that may be contained therein. The application software can store the personal settings of the user, and when examined from the outside, that is, from another operating system, these personal settings are often not visible or the software under study will not be able to download at all in another operating system environment

virtual machine; VirtualBox; information storage; operating system; computer technical expertise