VMDK Forensic Artifact Extractor (VFAE)


C++ application that triages, searches, and extracts files from VMDKs.

Add a Review
39 Downloads (This Week)
Last Update:
Download vfae1.2.rar
Browse All Files


VFAE is windows based tool written in C++ that extracts files from VMDK images running the Windows operating system. The tool utilizes the VDDK (Virtual Disk Development Kit) API for the heavy lifting such as mounting, opening, and reading the VMDK selected. When vfae.exe is executed, it copies out files from the off-line VMDK file. The application allows the user to conduct a quick triage of the Windows
directory structure by outputting the results to a specific output file. Additionally, it conducts a pre and post MD5 hash value of the VMDK itself if needed. For specific file searching purposes, it searches for any file type within the off-line VMDK based on a passed in argument via the command-line. Furthermore, you can extract those files that were found in a hard-coded "Extracted Files" directory as well as
provide the MD5 hash of each file that was extracted.

VMDK Forensic Artifact Extractor (VFAE) Web Site


  • Can perform pre and post MD5 hashing for your VMDK's.
  • Triage directory structure of windows based operating systems (virtual).
  • Search for specific file types after triage has taken place.
  • Extract files from off-line VMDK files to local disk with MD5 hash values of each file.

Update Notifications

Write a Review

User Reviews

Be the first to post a review of VMDK Forensic Artifact Extractor (VFAE)!

Additional Project Details

Intended Audience

Advanced End Users

User Interface


Programming Language



Screenshots can attract more users to your project.
Features can attract more users to your project.

Icons must be PNG, GIF, or JPEG and less than 1 MiB in size. They will be displayed as 48x48 images.