Linux Forensics Scenario

Good morning /r/computerforensics


I've got a hypothetical scenario I'd like to run by you -


I've got a Ubuntu VM. Suppose I create a partition, write files to that partition, and then delete the partition. How would I image the VM to obtain the disk slack that contained that partition? Do VMs even contain disk slack?


How about if I have partition sda, sdb, and sdc, aside from the naming convention, if I deleted sdb, any tips on identifying that …

computerforensics forensics linux linux forensics scenario