Forensic image of hard disk on VMWare using Autopsy

Asked Dec 06 '19 at 12:32

Active Dec 07 '19 at 12:31

Viewed 217 times

Is there a recommended, forensically sound method of acquiring virtual hard drives on VMWare using Autopsy? Or is it a simple copy and paste?

I’ve used other software like Caine in the past, where you take a copy of a hard disk using a “dd” command. Wondering if there is another method like this using Autopsy.

edited Dec 07 '19 at 12:31

asked Dec 06 '19 at 12:32

C.Mann

2

I think the best method would me to load a raw format of the disk into autopsy – Cyberduck Dec 06 '19 at 12:47
Thanks man appreciate it – C.Mann Dec 07 '19 at 02:37
just an evidence gathering activity, the idea is evidence must be "untouched", as long as you "proofconcept" evidence is "untouched", does not matter what tool is used right? – hakkican Dec 18 '19 at 11:10

Forensic image of hard disk on VMWare using Autopsy

0 Answers0