±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 1 Overall: 35140
New Yesterday: 10 Visitors: 194

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Virtual Machine Imaging

Computer forensics training and education issues. If you are looking for topic suggestions for your project, thesis or dissertation please post here rather than the general discussion forum.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts

Virtual Machine Imaging

Post Posted: Tue Jan 22, 2019 9:34 am


I am currently just testing some things with Windows registry, I wanted to look at the registry of a VM I have made. I have no idea how I go about imaging the hard drive of the VM and was wondering if anyone could guide me. (I am using VMWare Workstation 15.0).

If this is any useless information:

- Windows 10 machine.
- Virtual machine files are separated.

Thank you



Re: Virtual Machine Imaging

Post Posted: Tue Jan 22, 2019 10:03 am

Regarding Imaging, if you have FTK Imager, you can load the VM by selecting the first segment of the vmdk file. If you are just looking at pulling the registry files, you can select the first vmdk file and use the explorer function to look at the drive and find the registry files, and pull them out.  


Re: Virtual Machine Imaging

Post Posted: Tue Jan 22, 2019 1:34 pm

Thank you! This worked perfect, I didn't even think to try this I thought there was a process before you could read the data.  


Page 1 of 1