...The tool utilizes the VDDK (Virtual Disk Development Kit) API for the heavy lifting such as mounting, opening, and reading the VMDK selected. When vfae.exe is executed, it copies out files from the off-line VMDK file. The application allows the user to conduct a quick triage of the Windows
directory structure by outputting the results to a specific output file. Additionally, it conducts a pre and post MD5 hash value of the VMDK itself if needed. For specific file searching purposes, it searches for any file type within the off-line VMDK based on a passed in argument via the command-line. ...