In the VMware environment, Unity Mode presents guest VM applications to the host desktop. This provides a convenient way for the user to access applications installed on the guest without switching back and forth from the host to the guest. When a guest VM application is run in Unity Mode, the application appears in the host desktop just as a host application would.
To enable the guest-to-host communication required for Unity Mode, VMware stores information about guest applications in a directory called caches, nested within the directory where the .vmdk file is housed. Significant information about guest VM applications is recorded in the caches directory. This information is recorded whether or not the application is ever used in Unity Mode, and it persists after the application has been uninstalled from the guest VM. By examining the caches directory, a forensic examiner may be able to recover information such as:
- the names and full paths of all shortcuts ever present in the Start Menu of the guest;
- the date and time the shortcut were placed in the Start Menu;
- the icon used by the shortcut;
- the date on which the guest application was first run in Unity Mode (if applicable).