Hello:
I am trying to run autopsy on a VHD image of windows 11 computer.
The progress bar shows active but the screen turn black without any results.
I really need to anaylis the image ASAP. I will really appreciate any help with this.
Try to mount the vhd in a read only Mode and add the mounted VHD as a local drive in Autopsy.
Same kind of issue here, with a .vdi file (from VB).
Autopsy 14.9.3 can’t read the data as it appears “unallocated” on this Win11 VM. Any idea how to overcome this?
I’ve just tried mounting the image then adding it as local drive, same thing (tried with latest FTK Imager). I might try another software to see if that’s doing anything…
[EDIT] Guess it’s simply not compatible with .vdi files, since I tried with a .vhd and it works perfectly
Yes, vdi files cannot be read into Autopsy. If you convert the image to another format, ie:vmdk or vhd using vboxmanage. It will create a raw image in that format so be prepared to have enough storage to convert the file. HTH…