What are ways I can analyze malware in an infected machine, not just clean it?

I often run into infected devices in my environment and would like to learn more about the specific infections that have gotten in. What are the best tools and techniques I could use to do this? I was think taking an image of the device and creating a virtual machine so I could run tests, kill it and create a new infected vm from scratch.