VMDK File in Autopsy

Autopsy Help
1

Hello

I have a problem with this software. I have a virtual machine and inside the virtual machine I perform activities such as creating a file, deleting a file, creating a photo, and I enter the output of this virtual machine in VMDK format into the Autopsy software, but after taking the output from the software, none of I can’t see my files and there are files that have nothing to do with what I did recently. Thank you for helping me.

2

What virtualization software are you using? If you are using Hyper-V then you will have to consolidate the disk with the differences before you can examine it. If you are using VMWare or Virtual Box are you using snapshots?

Mark

1 Like
3

Vm ware and virtual box. no i use install version of os.