Virtual machine forensics is like opening up a Matryoshka doll--There's always more inside.