Re: [sleuthkit-users] TSK and VMDK
Brought to you by:
carrier
From: RB <ao...@gm...> - 2010-03-18 16:24:46
|
On Thu, Mar 18, 2010 at 09:58, Tony Rodrigues <dar...@gm...> wrote: > Is it possible to access VMDK files with TSK ? How can I do that ? This falls back to the ntfsclone discussion, and the answer is: no, not directly. You can: - use qemu-img or another similar tool to convert the VMDK to a raw image - use VMware Workstation's loopback tools to deal with it directly - use TSK linked against afflib that has been compiled with --enable-qemu image support |