I created a blog to discuss virtual machines and shadow volumes http//JustAskWeg.com/. I started with creating a VMware virtual machine from a dd image. I've progressed through shadow volume exams and preserving the evidence. I hope to post some more tutorials as time permits. I’m going to emphasize X-Ways Forensics, but will include some other tools, like Dan Mares’ VSS (free). Dan also produces some very handy, free tools for use with XWF. http//
Great blog Jimmy, really informative. Thanks for sharing your findings.
From the MaresWare page
"As of January 2010 Mares and Company will no longer be selling the Maresware software.
There will be minimal availability to selected individuals."
I think that Dan isn't "selling" software, but the free tools on his site are available. Perhaps the message should be changed, and I'll suggest that to Dan. VSS is, however, available near the botton of the right column.
Edit A modification of the site intro is in the works.