From df45da37157484b60d6a0be84c3c87f8bc6f0b57 Mon Sep 17 00:00:00 2001 From: StrangerealIntel <54320855+StrangerealIntel@users.noreply.github.com> Date: Sat, 8 Aug 2020 22:54:05 +0200 Subject: [PATCH] Update Analysis.md --- Additional Analysis/RagnarLocker/2020-08-08/Analysis.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Additional Analysis/RagnarLocker/2020-08-08/Analysis.md b/Additional Analysis/RagnarLocker/2020-08-08/Analysis.md index e174969..06cff71 100644 --- a/Additional Analysis/RagnarLocker/2020-08-08/Analysis.md +++ b/Additional Analysis/RagnarLocker/2020-08-08/Analysis.md @@ -367,8 +367,7 @@ Virtualbox.xml :

Now, we need to turn the VDI file which content the volume of the VM to an image of the volume IMG for to do a forensic introspection of the VM. For doing it, we use VBoxManage tool on Virtualbox folder for converting it in cloning the disk.

```bat ->VBoxManage.exe clonehd ".\filD45DC43C44044930A5265DB22D05BF15.vdi" ".\filD45DC43C44044930A5265DB22D05BF15.img -.img" --format raw +>VBoxManage.exe clonehd ".\filD45DC43C44044930A5265DB22D05BF15.vdi" ".\filD45DC43C44044930A5265DB22D05BF15.img" --format raw 0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100% Clone medium created in format 'raw'. UUID: 9f347ed8-3f5f-46f0-b275-fd9c4120f09d ```