This is the Windows app named VMDK Forensic Artifact Extractor (VFAE) whose latest release can be downloaded as vfae1.2.rar. It can be run online in the free hosting provider OnWorks for workstations.
Download and run online this app named VMDK Forensic Artifact Extractor (VFAE) with OnWorks for free.
Follow these instructions in order to run this app:
- 1. Downloaded this application in your PC.
- 2. Enter in our file manager https://www.onworks.net/myfiles.php?username=XXXXX with the username that you want.
- 3. Upload this application in such filemanager.
- 4. Start any OS OnWorks online emulator from this website, but better Windows online emulator.
- 5. From the OnWorks Windows OS you have just started, goto our file manager https://www.onworks.net/myfiles.php?username=XXXXX with the username that you want.
- 6. Download the application and install it.
- 7. Download Wine from your Linux distributions software repositories. Once installed, you can then double-click the app to run them with Wine. You can also try PlayOnLinux, a fancy interface over Wine that will help you install popular Windows programs and games.
Wine is a way to run Windows software on Linux, but with no Windows required. Wine is an open-source Windows compatibility layer that can run Windows programs directly on any Linux desktop. Essentially, Wine is trying to re-implement enough of Windows from scratch so that it can run all those Windows applications without actually needing Windows.
VMDK Forensic Artifact Extractor (VFAE)
DESCRIPTION:
VFAE is windows based tool written in C++ that extracts files from VMDK images running the Windows operating system. The tool utilizes the VDDK (Virtual Disk Development Kit) API for the heavy lifting such as mounting, opening, and reading the VMDK selected. When vfae.exe is executed, it copies out files from the off-line VMDK file. The application allows the user to conduct a quick triage of the Windowsdirectory structure by outputting the results to a specific output file. Additionally, it conducts a pre and post MD5 hash value of the VMDK itself if needed. For specific file searching purposes, it searches for any file type within the off-line VMDK based on a passed in argument via the command-line. Furthermore, you can extract those files that were found in a hard-coded "Extracted Files" directory as well as
provide the MD5 hash of each file that was extracted.
Features
- Can perform pre and post MD5 hashing for your VMDK's.
- Triage directory structure of windows based operating systems (virtual).
- Search for specific file types after triage has taken place.
- Extract files from off-line VMDK files to local disk with MD5 hash values of each file.
Audience
Advanced End Users
User interface
Command-line
Programming Language
C++
This is an application that can also be fetched from https://sourceforge.net/projects/vfae/. It has been hosted in OnWorks in order to be run online in an easiest way from one of our free Operative Systems.