Mind map of taking forensic image including memory for IR (vhd, vhdx, E01, vmdk etc)

 We will see how we can take forensic images in different format of windows and linux system as well as from cloud platforms. 

The reason of taking image is we cannot work on the system where malicious activity has happened. We may inadvertently spoil the evidence. Also for team distribution work, we need multiple copies of images for collaboration. 

One option is if the machine is physical/virtual windows --> We can use Microsoft's Sysinternal's tool Disk2vhd. Using this tool we can take vhd or vhdx format image. We can take C drive or whole drive image. 

For VMware ESXI --> Here you can take image along with memory. Locate the system and right click > Snapshots > Take snapshot 

Ensure this box is checked. Once this is completed, navigate to datastore on which the vm is stored.

Download both the .vmem and .vmsn file. Without the .vmsn the volatility will not work. 

For vmdk disk part:

Turn off the vm first. Without turning off the vm, you will get i.e. kb size of vmdk file which is not needed for forensic. 

When machine is off and you try to download the vmdk file, then you will see -flat keyword added while saving the file. 

If thick provision - then vmdk size will be larger because storage is fully assigned.

If thin provision - then vmdk size will be smaller as this is need to fill basis. 

For Hyper-V VM --> In hyper-v snapshots are referred here as checkpoints. Like vmware esxi, this is also the preferred way that I am showing you to acquire the memory. But before you take checkpoints of running guest, you need to change checkpoint type setting. You need to take it from its default state which Production checkpoints to Standard checkpoints. 

If you don't do this then memory will not be part of the checkpoint. On the location mentioned, you will find the checkpoints that will be created. Now once the setting is applied, right click on the machine and click Checkpoint. VMRS (memory image) is the file that you will get on the location. 

Now to export the disk --> Right click on the running or stopped machine > Export > Then provide the location > You will get vhd/vhdx file. 

You can experiment this by the way --> Shutdown the VM then go to the VM folder to collect .vhdx forensic copy of the hard drive. After taking snapshot you can export to VHDX. 

For Proxmox --> Coming soon

From GUI:

Now disk and ram is saved on the backend storage disk. 

Now we need to find out the vm disk path. First we need vmid. In proxmox we have individual vmid in front of each vm.

qm config vmid - syntax

qm config 104

scsi0: local-lvm:vm-104-disk-0 (You will get this output)

This is actually lvm thin volume so path will be /dev/pve/vm-104-disk-0

Now we need to export the disk to vhdx. Run the following command from proxmox shell. 

qemu-img convert -p -f raw -O vhdx /dev/pve/vm-104-disk-0 /mnt/forensic/vm-104-disk-0.vhdx

Ram will be saved here:

/var/lib/vz/snaps/<VMID>/snapshot-name.vmstate (You can use this file for forensic ram analysis using volatility, but you may need to convert this as well)

qemu-img convert -f raw -O raw snapshot-name.vmstate vm-104-memdump.raw

Integrity verification:

sha256sum /mnt/forensic/vm-104-disk-0.vhdx > vm-104-disk-0.vhdx.sha256

sha256sum /var/lib/vz/snaps/104/snapshot-name.vmstate > snapshot-name.vmstate.sha256

Exporting way:

Assuming external drive is already attached with proxmox host and mounted this way /mnt/forensic. In that case, you just unplug the drive and take it to the forensic machine. 

For VMware VM --> Native disk format is vmdk. You can use StarWind V2V converter tool to convert vmdk file to vhd/vhdx. You can also use qemu-img tool to convert the same.
qemu-img convert -O vpc disk.vmdk disk.vhd

VirtualBox --> VBoxManage clonehd disk.vdi disk.vhd --format VHD

For Linux physical server --> You can use FTK imager or dd or dcfldd or dc3dd tool to take the image in raw format. Then you can use qemu-img tool to convert the same.

dd tool by default installed on linux systems. 

For dcfldd: apt install dcfldd -y

For dc3dd: apt install dc3dd -y

dd if=/dev/sda of=disk.raw bs=4M conv=noerror,sync (The disk format also could be disk.img | disk.raw | disk.dd)
qemu-img convert -O vpc disk.raw disk.vhd

Process of taking master and child image:

dd if=/dev/sda of=master.img bs=4M conv=noerror,sync

Making child image with E01, E02 split:

ewfexport master.img

যদি disk বড় হয় (ধরা যাক 200 GB), তাহলে এটা split হয়ে যাবে:

child.E01

child.E02

child.E03 … ইত্যাদি।

For Linux vm server --> These vm are mostly in vmdk or qcow2 format. 
qemu-img convert -O vpc disk.qcow2 disk.vhd
qemu-img convert -O vpc disk.vmdk disk.vhd

If the linux disk is raw, then:

qemu-img convert -O vpc disk.raw linux.vhd

FTK imager tool --> Using this tool you can take .E01 or raw image. That can be converted to vhd using qemu-img tool. Also, vhd disk can be converted to .E01 using the FTK imager tool. 

Azure VM --> You can run Microsoft tool avml on the guest os to collect memory. 

For disk:

First from the Disks, we need to select the affected machine disk. Once there, we need to click on Create Snapshot. Fill the necessary info and click on Review + create. Snapshot type: Full. Once the validation is passed, click Create. Then click Go to resource. Then click Snapshot export. Then click Generate URLs. Finally click Download the VHD file. 

AWS EC2 VM --> Again you can run Microsoft tool avml on the guest os to collect memory. 

For disk: Coming soon

For evidence acquisition, E01 is best and for analysis vm making or other task, you can use vhd/vhdx/vmdk.

Another writeup of mine using kape tool to take vhd triage image: https://mahimfiroj.blogspot.com/2025/10/installing-kape-incident-response-tool.html

Qemu tool installation:

Debian/Ubuntu:

sudo apt update
sudo apt install qemu-utils

RHEL/CentOS/Fedora:

sudo yum install qemu-img
sudo dnf install qemu-img

For windows:

qemu-img.exe download this from the official site. 

Avi