±Forensic Focus Partners
|New Today: 1||Overall: 35530|
|New Yesterday: 7||Visitors: 111|
Back to top Skip to content Skip to menu Back to top Back to main Skip to menu
Merging vhdx and avhdx files
Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
I had a client ship us a hard drive with a virtual email server backup, which I then imaged to preserve the metadata etc. When I opened the image in FTK Imager, I noticed that the file they sent wasn't a vhd file like I expected, but two files. One was a vhdx and the other was an avhdx file. From everything I've found, you have to first merge these two files using Hyper-V Manager. So what I have done so far, is I mounted the image that I created, then I attempted to merge the two files through Hyper-V. So far, no luck. I've tried a few times, and the files just don't seem to merge and save. I've tried processing them in FTK Lab as well, but no data is extracted from them. I've searched the forums but didn't find anything on actually processing these types of files. I'm hoping someone might have some insight that can point me in the right direction to help me get this data extracted and processed for our investigation.