1. A computer system configured to acquire forensics data from running virtual machines, the computer system comprising: a processor configured to execute computer-executable instructions; and memory storing computer-executable instructions configured to: run a hypervisor that hosts a virtualization environment including a root virtual machine partition, an enlightened child virtual machine partition that is hypervisor-aware, an unenlightened child virtual machine partition that is non-hypervisor-aware, and a forensics partition that includes a forensics service application programming interface; provide access to a hypervisor-aware kernel, via an inter-partition communication mechanism supported by the virtualization environment, to the root virtual machine partition, the enlightened child virtual machine partition, and the forensics partition; wherein the forensics service application programming interface is configured to: acquire forensics data from a first virtual machine, running in the enlightened child virtual machine partition, via the inter-partition communication mechanism; acquire forensics data from a second virtual machine, running in the unenlightened child virtual machine partition, via a forensics switch, wherein the forensics switch is implemented by the root virtual machine partition and interconnects the forensics service application programming interface and the unenlightened child virtual machine partition, wherein the unenlightened child virtual machine partition does not support the inter-partition communication mechanism; and expose the forensics service application programming interface to a forensics tool.