I am currently in the middle of operating an analysis on Autopsy of a virtual machine (VMware) that has been hacked. I have mounted the VM and I am acquiring the evidence from VMware to my physical machine (Windows 10).
I am trying to do a Logical File Acquisition of certain files and folders ;
- Windows Event Viewer Logs (Application, System, Security) OpenSSH Logs
- Registry Keys
- NTUSER.DAT
- system32/config/SAM
However, file permissions Windows have installed is making it difficult for me to get hold of any of this. I don’t want to run a full physical as I’m only after certain artefacts.
Any recommendations would be appreciated greatly