Welcome to my blog and first post! This will be a multi-part presentation that goes into creating VMware virtual machines and using them to examine shadow volumes. First, we’ll create a virtual machine from a single dd image file.  In the next presentation, well examine the target system’s shadow volumes using VMware and X-Ways Forensics (XWF). We can create a target-system VM from a segmented image, but it takes more work to create our configuration file. We also can build a VM from other image formats, like E01, as long as we can mount the image as a physical disk. First, I always take care to see that my image file is read only. Our image file is MyImage.001. There are a variety of ways to approach an exam of shadow volumes, and this is mine at the moment. I’m using VMware 8.x, but the steps are the same in 7.x.Link: JustAskWeg