Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to use either Hyper-V or Vmware in order to find out after taking a Clean Base snapshot and a modified snapshot and what the modifications/differences and what was changed between the two images.

VMware ThinApp is the closest thing I can find to this as it show was was modified between the 2 images as it is trying to create a Virtualized Application. I am not interested in making an virtualized application I am more interested in how a few of our custom made old applications work and where they install to.

This could also be used for security purposes to see what changes were made to the system by a virus or malware.

Anyone have any ideas on how to measure or figure this out?

share|improve this question
    
I'm not clear on what sort of differences you want to detect - do you mean you want to know what files have been modified between 2 images? –  Cocowalla Jul 25 '12 at 13:23
add comment

1 Answer

I may be wrong, but I'm fairly certain that hypervisor based snapshots record the blocks that have changed on the virtual disk, not which files have been changed inside that virtual hard disk. Inside the guest OS you could use a file or filesystem level snapshot utility like volume shadow copy and I'm fairly certain a number of backup companies have created some utilities for doing some more efficient copying of virtualized data and certainly they have a way to check it.

Maybe you should look at other avenues for ensuring data integrity has not been compromised, by using an orchestration tool like puppet in concert with tripwire and MD5 checksums?

Also, consider posting to the security stack exchange instead, might be some more authoritative ideas for you there from people who do this day in and day out.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.