Imaging Virtual Ser...
 
Notifications
Clear all

Imaging Virtual Servers

3 Posts
3 Users
0 Likes
315 Views
(@harshbehl)
Posts: 67
Trusted Member
Topic starter
 

Hi All
I have a scenario where there are 2 EXSI servers running over a virtual environment. Both the servers are connected to a 16TB storage. I have been asked to image the servers. Each server is running one VM Machine (Windows Server 2012).
I have been trying to image via FTK Imager Lite by logging in the VM Machine and imaging virtual physical hard disk. For the first server its showing only one physical disk which i have imaged successfully. But the problem is that second server's VM is showing 5 physical disks. Do i have to image them indiviually ?
Is this the correct approach which i am following. I shall highly appreciate your advices. You can PM me at harsh_behl@live.com

 
Posted : 05/10/2015 11:18 pm
(@bithead)
Posts: 1206
Noble Member
 

Why would you not snapshot the virtual drives?

http//www.forensicfocus.com/downloads/virtual-machines-forensics-analysis.pdf

 
Posted : 06/10/2015 7:07 am
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

That's a great resource, Brett knows his stuff.

 
Posted : 06/10/2015 1:40 pm
Share: