The VM booted.
He ran a disk arbitration trace. The .vmdk had been mounted, written to, and unmounted in a loop—hundreds of times. Each cycle lasted exactly 5.3 seconds. This wasn't a user's virtual machine. It was a cron job . mac os vmware image
The sparsebundle mounted.
Elliot sat back. The missing piece: the sparsebundle's address was hardcoded in the script. He copied the URL, spun up a separate hardened Linux VM, and connected. The VM booted
Too clean.
Elliot opened the Console app. Logs streamed past. He filtered for vmm and vmnet . Nothing unusual. Then he searched for scheduler and timestamps . His eyes narrowed. mac os vmware image
He reached for his phone. The DA’s office picked up on the first ring.