Hi,
Just got a questions about forensics of virtual harddisks.
I've got an image of a Server 2008 R2.
There are a couple of vhd and avhd files on this server. Each 'set' contains 1 vhd and a couple of avhd files, the vhd is always the oldest file (last written).
It looks like the changes are written to the avhd file. Encase support vhd files but not avhd files and a simple rename didn't solve the problem.
What are the best practices to merge the avhd and vhd files or some other way to investigate these virtual harddisks.
I fired a Google search, and the first two results have the instructions on merging the two files.
https://
and
http//
More information https://
Of course I found that too.
But now the forensic part….
Each snapshot (avhd file) could contain evidence that isn't available in a newer snapshot.
How to identity which snapshots belong to each other, like
Take 2 snapshot A and B.
Take a snapshot from A, call it AA
Take a snapshot from B, call it BB.
Snapshot AA belongs to Branch A and not to Branch B.
Curious if some1 made a paper/blog post about this topic. D