AUTOMATION OF VHDX INVESTIGATIONS

Summary from the TLDR InfoSec newsletter

Virtual Hard Disk (VHDX) files are commonly generated by Virtual Desktop Infrastructure (VDI) environments and can be very useful to forensic investigators. Velociraptor is frequently used in investigations but fails to discover or parse the NTUSER.DAT hives in VHDX files without injecting a synthetic ProfileList registry hive or customizing the Windows.Sys.Users artifact to support VHDX discovery logic. To perform this analysis at scale, a single remapping configuration can be used, multiple virtual Velociraptor clients can be launched, or a batch processing approach can be used as a middle ground.