Acquiring disks is a very important part of digital forensics. In my past blogs I discussed some aspects of forensics with respect to VMware ESX servers. This is the last part of the series. To acquire a VM from a VMFS you must use a forensically sound method. One that duplicates the blocks used by the VM disk, memory, and meta files…
