🧬 Exhume Body

The exhume Body module is part of the exhume toolkit and is allowing you to examine, investigate and abstracting a body of data using different file formats.

The current supported formats are:

• RAW
• EWF
• VMDK

VMFSSparse (ESXi snapshots, delta files, linked clones) and full physical disk or partition-wide VMDK volumes are not supported.

📄 Getting started

You can find the full installation and usage guide here: https://www.forensicxlab.com/docs/category/exhume---body

Related Blog posts

• 🔦 Debunking the Expert Witness Compression Format (EWF)
• 🔦 A quick walkthrough in the VMDK format