Type 1 hypervisors are usually the ones you find loaded on a suspect machine.

• A. True
• B. Half the time
• C. False
• D. Never

Answer: (C)

Type 1 hypervisors run directly on hardware, handling all virtualization without an intervening host operating system. They’re typical in dedicated virtualization servers or data-center appliances, where the system’s purpose is to host multiple virtual machines. On a ordinary suspect machine, you’d normally see a standard operating system with a software-based virtualization layer (or no virtualization at all). That’s why this statement isn’t generally true: a suspect desktop or laptop is much more likely to have a Type 2 hypervisor running inside its OS, or nothing at all, rather than a bare-metal hypervisor already loaded. If you did encounter a Type 1 setup, it would indicate the machine is functioning as a dedicated virtualization host, which is less common in typical forensic cases.