Re: [sleuthkit-users] VHDX
Brought to you by:
carrier
From: Derrick K. <dk...@gm...> - 2022-05-17 22:01:35
|
Hello. There are a few ways of doing this. In Linux you could use 'qemu-image' to convert the VHDX to .E01 or use 'guestmount' from libguestfs-tools to mount it and then image it. In Windows you could also load the VHDX image up in X-Ways and image it out to a .E01. I believe Arsenal Image Mounter will also allow you to expose it to Windows. Finally, if I recall, you can use disk manager in Windows to attach a vhd/vhdx to the system. On Tue, May 17, 2022 at 3:46 PM Mark Fisher <new...@gm...> wrote: > Hi, > I have been given a VHDX image, and have tried many ways to create an > .E01 forensics image from this VHDX image, using Access Data's FTK Imager. > Unfortunately, they all failed to load correctly into Autopsy. > > Please could anybody tell me if this should work with a VHDX (not vhd) > image? > > Although the file hashes were preserved, I could see no time-stamps in > Autopsy using any of the methods I tried. > > The versions I have used are > > AccessData® FTK® Imager 4.2.1.4 > > Autopsy 4.17.0 (RELEASE) Sleuth Kit Version: 4.10.1 > > Many thanks > > > <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail> Virus-free. > www.avast.com > <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail> > <#m_-7603269990275290925_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2> > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org > |