====== Forensic ======
{{:forensic.jpg|Forensic}}
===== Disk dump into virtual machine =====
<code>
VboxManage convertfromraw img.raw output.vdi --format VDI
</code>

===== Windows =====
[[https://www.jaiminton.com/cheatsheet/DFIR/#|Windows Forensic]]