Here's the scenario
Windows 2008 Server running on an HP Proliant box utilizing a six disk Raid. On this machine, there are three virtual machines that are controlled by Hyper-V Manager such as \\vmfs1. When I ran EnCase portable looking for documents, it only exported the files from the boot volume and ignored the virtual servers.
The documents I need are in the virtual machines and I'm trying to think of the best way to get them without taking the server down which is not an option.
Any and all suggestions or ideas would be greatly appreciated.
The documents I need are in the virtual machines and I'm trying to think of the best way to get them without taking the server down which is not an option.
Can you access the VMs in the same manner as you did the host system?
I may be able to but am not sure at this point. If I can, I don't believe that EnCase portable has the ability to be pointed to it for a targeted collection.
I may be able to but am not sure at this point. If I can, I don't believe that EnCase portable has the ability to be pointed to it for a targeted collection.
Why not? You were able to do it on the host…
So let me ask you…how did you perform the collection on the host?