I recently determined the format for timestamps indicating when VMware Snapshots were initially created, as logged in the *.vmsd file.
Tag: tips
How Long Will That Image Take?
Acquiring forensic images can be one of the most dreaded steps in most analysts’ processes. It’s documentation-heavy, not terribly interesting to watch, and thanks to the ever-increasing size of commercial hard drives, it can take a LONG time. Thanks to the unrealistic portrayals of this process in movies and TV shows, it’s not uncommon for… Continue reading How Long Will That Image Take?