We have a win 2008 server. On it other two win2008r2 passing by hyper V
Now someone stole and deleted data's. Which should be the correct procedure to follow?
thanks in advance
two win2008r2 passing by hyper V. Now someone stole and deleted data
What's your goal? To collect evidence or to recover the lost data from the hyper V?
BOTH! Collect evidence and recover the lost data. I was asking which is the best way to acquire the virtuaL server (vhd file)
thanks
Without knowing where the storage for the VMs is and how it can be accessed it would be nearly impossible question to provide any sort of meaningful answer.
Is the storage internal to the host? Attached by fiber channel? iSCSI? DAS?
the vhd file is in a partition of the hard disk.
thanks
the vhd file is in a partition of the hard disk.
thanks
Then it is a file like any other file, what is the issue?
Is the .vhd file contiguous?
Is the .vhd a static, a dinamic and/or has it a "redo/undo" vhd?
jaclaz
the vhd file is in a partition of the hard disk.
Then jaclaz is right - logical scan is a thing to start from. I nearly don't work with other data recovery software, but UFS Explorer should do the job.
Perform a full scan, should there be any complications, I'll be happy to help with recovery if necessary.
It's a manual work, but we've been reassembling remotely obviously more damaged virtual machines.