Hi All
I have a scenario where there are 2 EXSI servers running over a virtual environment. Both the servers are connected to a 16TB storage. I have been asked to image the servers. Each server is running one VM Machine (Windows Server 2012).
I have been trying to image via FTK Imager Lite by logging in the VM Machine and imaging virtual physical hard disk. For the first server its showing only one physical disk which i have imaged successfully. But the problem is that second server's VM is showing 5 physical disks. Do i have to image them indiviually ?
Is this the correct approach which i am following. I shall highly appreciate your advices. You can PM me at harsh_behl@live.com
Why would you not snapshot the virtual drives?
http//www.forensicfocus.com/downloads/virtual-machines-forensics-analysis.pdf
That's a great resource, Brett knows his stuff.