# Converting Windows VHDX file into Autopsy

**URL:** <https://sleuthkit.discourse.group/t/converting-windows-vhdx-file-into-autopsy/3827>\
**Category:** Autopsy Help\
**Created:** [June 29, 2023, 2:11pm UTC](https://sleuthkit.discourse.group/t/converting-windows-vhdx-file-into-autopsy/3827 "2023-06-29T14:11:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![readysetgo](https://avatars.discourse-cdn.com/v4/letter/r/e95f7d/32.png) [@readysetgo](https://sleuthkit.discourse.group/u/readysetgo)\
**Post date:** [June 29, 2023, 2:11pm UTC](https://sleuthkit.discourse.group/t/converting-windows-vhdx-file-into-autopsy/3827/1 "2023-06-29T14:11:10Z")

</div>

I created a laptop system image by using the built-in Windows feature “Backup and Restore (Windows 7)” - this outputs 3 different .VHDX files:

1. EFI System Partition
2. C: Drive (System)
3. Windows Recovery Environment (System)

Which one would I use to do a forensic analysis? The 3rd one is very large.

How do I convert a .VHDX and which file type do I convert it to? (ie. RAW dd, E01, etc.)

Any assistance would be appreciated. Thank you!

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [June 29, 2023, 3:30pm UTC](https://sleuthkit.discourse.group/t/converting-windows-vhdx-file-into-autopsy/3827/2 "2023-06-29T15:30:01Z")

</div>

FTK Imager will convert a VHDX to E01/raw file for you, FTK Imager is free. As to which one I would say 2 since that is your Windows root drive but it depends on what questions you are trying to answer and what you want to accomplish.