Building a cybersecurity home lab is rarely a straight path. It usually starts with excitement, then quickly turns into duplicated virtual machines, broken installs, and unclear storage usage.
This post documents how I cleaned up and reorganized my Debian-based cybersecurity lab running VMware Workstation, and how I structured my virtual machines for better performance, clarity, and usability.
🖥️ Lab Overview
My setup is based on:
- Host OS: Debian 13 (Trixie)
- Kernel: 6.12.x
- Virtualization Platform: VMware Workstation 17.6.4
- Hardware Virtualization: VT-x enabled (confirmed working)
Inside the lab, I run multiple virtual machines for cybersecurity practice:
- Kali Linux (penetration testing)
- CSI Linux CMS (digital forensics / OSINT)
- Windows 11 (target environment)
- Red Hat Enterprise Linux 10 (enterprise simulation)
- Ubuntu (general Linux testing)
⚠️ The Problem: VM Chaos
Over time, my lab became messy. I ended up with:
- Duplicate CSI Linux installations
- Multiple incomplete Linux test VMs
- A broken or unused BlackArch install attempt
- Unclear storage usage across VM folders
This created three main issues:
- ❌ Wasted disk space
- ❌ Confusing VM list inside VMware
- ❌ Unreliable installations and boot issues
At one point, I had multiple CSI Linux VMs that were not actually needed.
💾 Checking Disk Usage
To understand what was happening, I analyzed VM storage:
du -sh ~/vmware/* | sort -hThis revealed that my virtual machines were consuming large amounts of space, with some duplicates taking up tens of gigabytes each.
🧹 The Cleanup Process
I then reviewed each VM folder and identified:
- Which VMs were functional
- Which ones were duplicates
- Which ones were incomplete or broken
I removed unnecessary virtual machines:
rm -rf ~/vmware/CSI2026
rm -rf ~/vmware/CSI-Linux-2026These were older or incomplete CSI Linux installations that were no longer needed.
After cleanup, my VMware directory was reduced to a clean and usable structure:
CSI Linux CMS 2026.4 VMware
Kali Linux
Red Hat Enterprise Linux 10 64-bit
Ubuntu 64-bit🧠 Verifying Virtualization Support
To ensure everything was properly configured, I verified hardware virtualization support:
sudo /usr/sbin/kvm-okResult:
INFO: /dev/kvm exists
KVM acceleration can be usedThis confirmed that my system supports hardware virtualization and is fully capable of running virtual machines efficiently.
⚙️ VMware Version Check
I also verified my virtualization software version:
vmware -vResult:
VMware Workstation 17.6.4 build-24832109This is a modern, stable release and works well with Debian 13 and kernel 6.12.
No upgrade was necessary.
🧱 Final Lab Structure
After cleanup, my cybersecurity lab now follows a clean structure:
🔵 Attack Environment
- Kali Linux
🔴 Forensics / OSINT
- CSI Linux CMS 2026.4
🟡 Target Systems
- Windows 11
- Red Hat Enterprise Linux 10
🟢 General Testing
- Ubuntu 64-bit
This separation makes the lab more realistic and easier to manage.
🚀 Key Improvements Achieved
After cleanup and verification, I achieved:
- 🧹 Removed duplicate and broken VMs
- 💾 Freed significant disk space
- 🧠 Confirmed hardware virtualization support
- ⚙️ Verified VMware stability
- 🧱 Organized lab into clear functional roles
📌 Lessons Learned
A few important takeaways from this process:
- Always document VM purpose when creating it
- Avoid duplicate installs unless necessary
- Regularly check disk usage with
du - Keep lab roles clearly separated (attack, defense, forensics)
- Clean up unused ISO files and test environments
🧭 Next Steps
The next improvements for my lab will include:
- Optimizing VM performance (RAM/CPU tuning)
- Creating snapshot workflows for quick rollback
- Networking VMs into a simulated cyber range
- Testing controlled attack/defense scenarios between machines
🧠 Final Thoughts
A cybersecurity lab is not just about installing tools — it’s about maintaining structure, clarity, and control over your environment.
This cleanup step made my lab faster, more stable, and much easier to work with going forward.