Re: [sleuthkit-users] VHDX

[Derrick K. <dk...@gm...>]

Hello.

There are a few ways of doing this. In Linux you could use 'qemu-image' to
convert the VHDX to .E01 or use 'guestmount' from libguestfs-tools to mount
it and then image it. In Windows you could also load the VHDX image up in
X-Ways and image it out to a .E01. I believe Arsenal Image Mounter will
also allow you to expose it to Windows. Finally, if I recall, you can use
disk manager in Windows to attach a vhd/vhdx to the system.


On Tue, May 17, 2022 at 3:46 PM Mark Fisher <new...@gm...> wrote:

> Hi,
> I have been given a VHDX image, and have tried many ways to create an
> .E01 forensics image from this VHDX image, using Access Data's FTK Imager.
> Unfortunately, they all failed to load correctly into Autopsy.
>
> Please could anybody tell me if this should work with a VHDX (not vhd)
> image?
>
> Although the file hashes were preserved, I could see no time-stamps in
> Autopsy using any of the methods I tried.
>
> The versions I have used are
>
> AccessData® FTK® Imager 4.2.1.4
>
> Autopsy 4.17.0 (RELEASE) Sleuth Kit Version: 4.10.1
>
> Many thanks
>
>
> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail> Virus-free.
> www.avast.com
> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
> <#m_-7603269990275290925_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>