Acquisition from **virtual machines** requires additional planning. Unlike a server, desktop, or laptop, a VM is often running in a shared environment, where removal of the system would cause disruption to multiple other servers and services. At the same time, *imaging the entire underlying virtualisation host would include more data and systems* than may be needed or appropriate for the forensic investigation that is in progress. Fortunately, a **virtual machine snapshot** will provide the information that forensic analysts need and can be captured and then imported into forensic tools using available tools. **Containers** have grown significantly in use and create new challenges for forensic examiners. Since containers are *designed to be ephemeral*, and their resources are often shared, they create fewer forensic artefacts than a virtual or physical machine. In fact, though containers can be paused, *capturing them and returning them to a forensically sound state can be challenging*. Container forensics require additional planning and forensic and incident response tools are becoming available to support these needs.