Virtual machine

A virtual machine permits the examiner to use a copy of the data from the seized device and recreate how the device would have appeared and functioned at the time it was seized. Using what is often referred to as VM software, the examiner can display to the court how the device would have appeared to the user, showing what was visible, what was accessible, and what steps would have been required to access the data in issue.