[sleuthkit-users] VHDX

[Mark F. <new...@gm...>]

 Hi,
I have been given a VHDX image, and have tried many ways to create an .E01
forensics image from this VHDX image, using Access Data's FTK Imager.
Unfortunately, they all failed to load correctly into Autopsy.

Please could anybody tell me if this should work with a VHDX (not vhd)
image?

Although the file hashes were preserved, I could see no time-stamps in
Autopsy using any of the methods I tried.

The versions I have used are

AccessData® FTK® Imager 4.2.1.4

Autopsy 4.17.0 (RELEASE) Sleuth Kit Version: 4.10.1

Many thanks

<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Virus-free.
www.avast.com
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>