I created a laptop system image by using the built-in Windows feature “Backup and Restore (Windows 7)” - this outputs 3 different .VHDX files:
- EFI System Partition
- C: Drive (System)
- Windows Recovery Environment (System)
Which one would I use to do a forensic analysis? The 3rd one is very large.
How do I convert a .VHDX and which file type do I convert it to? (ie. RAW dd, E01, etc.)
Any assistance would be appreciated. Thank you!