±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36768
New Yesterday: 0 Visitors: 124

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Virtual Machine Imaging

Computer forensics training and education issues. If you are looking for topic suggestions for your project, thesis or dissertation please post here rather than the general discussion forum.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts


Virtual Machine Imaging

Post Posted: Jan 22, 19 16:34


I am currently just testing some things with Windows registry, I wanted to look at the registry of a VM I have made. I have no idea how I go about imaging the hard drive of the VM and was wondering if anyone could guide me. (I am using VMWare Workstation 15.0).

If this is any useless information:

- Windows 10 machine.
- Virtual machine files are separated.

Thank you



Re: Virtual Machine Imaging

Post Posted: Jan 22, 19 17:03

Regarding Imaging, if you have FTK Imager, you can load the VM by selecting the first segment of the vmdk file. If you are just looking at pulling the registry files, you can select the first vmdk file and use the explorer function to look at the drive and find the registry files, and pull them out.  


Re: Virtual Machine Imaging

Post Posted: Jan 22, 19 20:34

Thank you! This worked perfect, I didn't even think to try this I thought there was a process before you could read the data.  


Re: Virtual Machine Imaging

Post Posted: Mar 04, 19 13:26

A virtual machine is a software computer that, as a physical computer, runs on an operating system and computer. A virtual machine comprises of various configuration files and is backed up by the physical resource of a host. every virtual machine has a virtual device that provides the same functionality as physical hardware and has the additional benefit in terms of portability and security.

It consists of several files that you store on supported storage devices. A virtual file can have more files if one or more snapshot exist or if you add Raw Device Mappings.  

Senior Member

Re: Virtual Machine Imaging

Post Posted: Mar 05, 19 02:20

Unlike a physical machine, you can simply "copy" the virtual drive (.vmdk), no imaging necessary.  


Re: Virtual Machine Imaging

Post Posted: Nov 15, 19 11:27

Thanks Watcher  

Page 1 of 1