±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 1 Overall: 35530
New Yesterday: 7 Visitors: 111

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Merging vhdx and avhdx files

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts


Merging vhdx and avhdx files

Post Posted: Jan 30, 19 15:31

I had a client ship us a hard drive with a virtual email server backup, which I then imaged to preserve the metadata etc. When I opened the image in FTK Imager, I noticed that the file they sent wasn't a vhd file like I expected, but two files. One was a vhdx and the other was an avhdx file. From everything I've found, you have to first merge these two files using Hyper-V Manager. So what I have done so far, is I mounted the image that I created, then I attempted to merge the two files through Hyper-V. So far, no luck. I've tried a few times, and the files just don't seem to merge and save. I've tried processing them in FTK Lab as well, but no data is extracted from them. I've searched the forums but didn't find anything on actually processing these types of files. I'm hoping someone might have some insight that can point me in the right direction to help me get this data extracted and processed for our investigation.  

Page 1 of 1