VHDX Containerization

Forensic Email Collector (FEC) allows creating VHDX disk images to store acquired data such as emails and cloud files. Created VHDX containers are hashed and their hashes are recorded in FEC’s logs.

Benefits

This approach has a couple of benefits:

1. Container level hashing makes chain of custody tracking easier. For example, FEC’s entire MIME output can be kept in a hashed VHDX container. Checking the container hash allows quick verification that the entire MIME output has not changed since the acquisition.

2. In addition to item contents, file system timestamps of the items acquired by FEC are valuable as they reflect server metadata. Storing loose items in a VHDX container makes it easier to preserve file system timestamps and allows hash verification to also cover file system metadata.

Creation and Options

It is possible to schedule the creation of VHDX containers during project setup by setting the containerization options on the Output Settings Page. Alternatively, one can trigger containerization at any time from the End of Acquisition Page or Post-Acquisition Actions.

FEC offers two variants of VHDX containerization:

1. Direct VHDX Containerization (default): In this mode, FEC creates the VHDX container from scratch, without using the VHDX capabilities built into Windows. The main benefit of this approach is that it does not require elevation to administrator privileges.

Tip

If you would like to mount a VHDX container created using the Direct VHDX Containerization method in a read-only manner, we recommend using mounting software that allows the operating system to perform “virtual” write operations on the disk image by directing the differencing data elsewhere, such as to a temporary file or RAM.

For example, you can use the following settings with Arsenal Image Mounter:

"Disk device, write temporary" -> "Store differencing data in host RAM only"

2. Native VHDX Containerization: This option uses the VHDX capabilities built into Windows and requires admin elevation (UAC).

Caution

For security reasons, we do not recommend elevating the main FEC application to admin and performing your entire acquisition in elevated mode. Instead, when containerization is triggered, FEC launches a separate process for the express purpose of containerization and that process asks for admin elevation.

The Native VHDX Containerization approach has two main benefits:

• Performance is better for very large containers with millions of items.
• VHDX containers created this way can be mounted as is from a read-only medium by Windows.

Note

Because this approach requires admin elevation, Native VHDX Containerization cannot be scheduled during project creation and is only available as a post-acquisition action.

Usage

Depending on your tool stack and workflow, resultant VHDX disk images can be mounted as a drive in a read-only manner or ingested directly into forensic tools, eDiscovery processing tools, and legal review software.