1

I have an AVHDX file that is part of a broken snapshot chain. However, I'm fairly certain there will be useful contiguous data on the last AVHDX in the chain, if I can run forensic tools on it. I have a tool under a Linux VM ready, and want to attach the AVHDX as a new IDE drive, but HyperV tells me it's corrupted when I try to click OK in the Settings dialog of the VM. Is there some way to force it to accept the AVHDX despite corruption and still have it boot?

Kev
  • 964
  • 4
  • 23
  • 46

1 Answers1

0

I don't think there's any way to get Hyper-V to mount just that partial snapshot file.

But your linux forensic tools should be able to operate on a file just as well as they do on an IDE drive. One of the beautiful things about linux is that it treats everything like a file. Just copy the file itself to the linux VM and work on it from there.

You may need to use the ''losetup'' command in linux to create a loopback and mount the file as a virtual disk, if your tools can't operate directly on the file.

Grant
  • 17,671
  • 14
  • 69
  • 101