Workarounds to Workarounds (and some hints & reminders)
Every now and then, I get email from readers who have difficulties, and some areas come up more often. I also learn a few things as time goes by, and I gain some valuable pointers from colleagues who share my interests. Therefore, I want to…
Read MoreA Quicker Way to the Shadow Volumes and Dealing with Win 8 VHDXs
Arsenal Image Mounter (AIM) is a new image-mounting tool from Arsenal Recon. Not only is it free, but the folks at Arsenal have been gracious in lending support. AIM employs a special SCSI driver that lets us mount image files of various…
Read MoreRAIDs & Virtual Machines
After a colleague posed a question about building VMs from RAIDs, I thought it might be a good topic for a post. I won’t go into RAID basics, as you probably have a good grasp of that topic already if you’re visiting my site. The RAID…
Read MoreGetting a Quick Look at Shadow Volumes
We’ve come to the point where we can conduct a rather complete exam of shadow volumes using dd and E01 image files. Let’s say that we don’t need to do such a complete exam. For example, we’re confident that one, particular folder may contain…
Read MoreMounting Shadow Volumes
We’ve built our SEAT VM and added our target image to it as a virtual disk. The first thing that I do is verify that all of the shadow volumes are present. My first post presented a screen shot from the image file (MyImage) and depicted the…
Read MoreAdding Our Target System to Our SEAT Workstation
In this step we’ll add our target system virtual disk to our SEAT VM. We already have the target (MyImage) virtual disk that we created, and we’ll add it to our system as in the next video. Add Virtual Disk As you saw, we chose to add the disk as…
Read MoreGetting Ready for a Shadow Volume Exam
We now have built a virtual machine from an image of the target system. Next, we’ll build a Windows 7 VM and configure it as our examination platform: Shadow Examination and Analysis Technique (SEAT) workstation. Building the VM basically is…
Read MoreCreating a VMware Virtual Machine from a Raw Image File
Welcome to my blog and first post! My aim is to provide tutorials that describe some of the things about which my colleagues have questions. I’m neither a seasoned blogger nor videographer, so please bear with me as I progress. I…
Read More