Converting Windows VHDX file into Autopsy

Autopsy Help
1

I created a laptop system image by using the built-in Windows feature “Backup and Restore (Windows 7)” - this outputs 3 different .VHDX files:

  1. EFI System Partition
  2. C: Drive (System)
  3. Windows Recovery Environment (System)

Which one would I use to do a forensic analysis? The 3rd one is very large.

How do I convert a .VHDX and which file type do I convert it to? (ie. RAW dd, E01, etc.)

Any assistance would be appreciated. Thank you!

2

FTK Imager will convert a VHDX to E01/raw file for you, FTK Imager is free. As to which one I would say 2 since that is your Windows root drive but it depends on what questions you are trying to answer and what you want to accomplish.