| <<< Local Drive Analysis (cont.) | Index | Making a VHD File in Autopsy >>> |
Making a VHD File allows to make a sparse VHD image for analyzing a local drive.
Useful for triage situations
When data is read, Autopsy determines if it has seen that sector before. If not, it saves a copy.
If you analyze the entire drive, you'll get a complete image.
We'll cover this more in the later Triage section
| <<< Local Drive Analysis (cont.) | Index | Making a VHD File in Autopsy >>> |