Membership

Recovering virtual machines from lost VMFS partitions (W29)

Study the recovery of virtual machines from lost VMFS partitions. Connect VMware storage concepts, Linux tools, and raw-image analysis in a recovery workflow. This is an earlier course edition; examples reflect the tools and versions used when it was recorded.

Instructor · Washington Umpierres de Almeida Junior

Modules:
3
Lessons:
24

eForensics learning

Practical skills.
Verified progress.

What you'll learn

  • Use dcfldd to generate disk or volume images.
  • Examine partition information with losetup and fdisk.
  • Explore recovery of virtual machines from lost VMFS partitions.

Prerequisites

Basic concepts of the Linux operating environment; Basic concepts on RAW Images; Basic understanding of VMware environment. Equipment and software: Basic concepts of the Linux operating environment; Basic concepts on RAW Images; A small volume 2.0Gb drive just for exercising RAW imaging.

Module 2

Course materials

  1. 1. (W29M02) Introduction to Recovering Virtual Machines

  2. 2. (W29M00) Understanding Virtualization & About VMWare VMFS

  3. 3. (W29M00) About the command line interface (used in the course)

  4. 4. (W29M00) About FTK Imager & R-Studio

  5. 5. (W29M03) Exploring Windows Possibilities Part 1 - FTK Imager

  6. 6. (W29M04) Exploring Windows Possibilities Part 2 - R-Studio

  7. 7. (W29M00) Disk Cloning and Imaging & Tools for VMFS Recovery

  8. 8. (W29M05) Disk Cloning and Disk Imaging

  9. 9. (W29M06) Preparing Kali Linux Environment

  10. 10. (W29M07) Practice Exercise - Creating a RAW image

  11. 11. (W29M08) Explore the RAW image file in Windows environment

  12. 12. (W29M09) Mounting Devices Part 1 - mount cli

  13. 13. (W29M10) Mounting Devices Part 2 - losetup cli

  14. 14. (W29M00) VMFS tools

  15. 15. (W29M11) Installing vmfs-tools

  16. 16. (W29M12) Using vmfs-tools to access damaged/lost partitions

  17. 17. (W29M13) Extra Video 1 - Setting Kali Environment

  18. 18. (W29M14) Extra Video 2 - Managing Packages

  19. 19. (W29M15) Extra Video 3 - VirtualBox Extra Setting

  20. 20. (W29M16) Course Closure

Module 3

Course assignments

  1. 1. Practice: (W29Q01)

Assessments

Assignment Required

(W29A01) Practical Lab

Quiz Required

(W29Q01) Recovering VM from lost VMFS partitions Final Exam

Course access

Unlock Recovering virtual machines from lost VMFS partitions (W29).

Enter your email. We’ll send a sign-in code here without taking you away from this course.