Join Us!

Imaging Virtual Ser...
 
Notifications
Clear all

Imaging Virtual Servers  

  RSS
harshbehl
(@harshbehl)
Member

Hi All
I have a scenario where there are 2 EXSI servers running over a virtual environment. Both the servers are connected to a 16TB storage. I have been asked to image the servers. Each server is running one VM Machine (Windows Server 2012).
I have been trying to image via FTK Imager Lite by logging in the VM Machine and imaging virtual physical hard disk. For the first server its showing only one physical disk which i have imaged successfully. But the problem is that second server's VM is showing 5 physical disks. Do i have to image them indiviually ?
Is this the correct approach which i am following. I shall highly appreciate your advices. You can PM me at [email protected]

Quote
Posted : 06/10/2015 12:18 am
BitHead
(@bithead)
Community Legend

Why would you not snapshot the virtual drives?

http//www.forensicfocus.com/downloads/virtual-machines-forensics-analysis.pdf

ReplyQuote
Posted : 06/10/2015 8:07 am
Adam10541
(@adam10541)
Senior Member

That's a great resource, Brett knows his stuff.

ReplyQuote
Posted : 06/10/2015 2:40 pm
Share: