VirtualBox Cybersecurity Lab VM

My role

Mohamad owns and uses the lab VM. The October 2026 drive move was done by Claude (AI) as part of a storage plan he approved. The VM image itself looks course-provided; its origin is not documented, so no course is claimed.

What it is

This is a single VirtualBox virtual machine named "Cybersecurity LabVM Worksation 20250409" (spelling as on disk). It is an Ubuntu 64-bit guest with 2 CPUs, 2048 MB of RAM, two virtual disks and one NAT network adapter, set up as a safe place to practise cybersecurity tasks without touching the host PC.

The name pattern suggests a lab image dated 9 April 2025, but where it came from is not documented, so this page does not say which course or program it belongs to. The contents of the disks were deliberately not opened for this write-up.

The documented hands-on work is lifecycle management: the VM was moved from the system drive to a 16 TB data drive with VirtualBox's own move command, so the machine kept working and the system drive got space back.

How it was built

1. Get the lab imageA VirtualBox machine named "Cybersecurity LabVM Worksation 20250409" exists on the PC. The name pattern points to a ready-made lab image; its source is not documented.
2. Guest configurationThe .vbox file shows an Ubuntu 64-bit guest, 2 CPUs and 2048 MB RAM, with two VDI disks (disk001 and disk002).
3. NetworkingOne network adapter in NAT mode, so the guest reaches the internet through the host but is not exposed on the home network. The guest log shows the standard NAT address 10.0.2.15.
4. Run on the hostThe host has about 32 GB of RAM. The VirtualBox log from 2026-07-28 shows VirtualBox 7.2.14 starting the VM; the VM state records an unclean shutdown (aborted) at 22:08 UTC the same day.
5. Spot a storage problemOn 2026-10-28 a storage audit found the system drive had only 52 GB free; the VirtualBox VMs took about 7.8 GB of it.
6. Move with the supported toolThe VM was relocated to a second drive using VBoxManage movevm rather than copying files by hand, so VirtualBox updated its own registration.
7. Confirm the resultAfterwards the folder on a second drive holds the .vbox file, two .vdi disks and the logs (VBox.log plus two rotated logs and a hardening log), and VirtualBox points at that location.

Decisions and why

Use NAT networking

It keeps a practice machine away from the real home network while still allowing updates and downloads.

Move the VM with VBoxManage movevm

The supported command updates VirtualBox's registration; copying disk files by hand can break the VM.

Do not open or describe the disk contents

The image may include licensed course material, so only the specs are shared.

Hardest problems

Freeing space on a nearly full system drive without breaking a VM

Used the VirtualBox move command to relocate it to the large data drive as one step of a measured storage plan.

The VM last stopped uncleanly (aborted flag in its state file)

Not documented as fixed. It is recorded here honestly as an open item rather than skipped.

Numbers

Timeline

• 2025-04-09Date in the lab image name (from the name only)
• 2026-07-28VirtualBox 7.2.14 session logged; VM state recorded as aborted at 22:08 UTC
• 2026-10-28VM moved to a second drive with VBoxManage movevm to free space on the system drive

What I took from it

• Use the vendor's supported move or export command for VMs instead of copying files.
• A lab environment is only evidence of setup; claims about lab results need their own notes, and none exist yet.
• Measure disk use first, then move the safe items.