This week I talk File Use & Knowledge investigations involving virtual machines. This is mainly from a dead-box exam point-of-view.