Content Server Upgrade
Analyze VMWare snapshots in EnCase
I have created a virtual machine in VMWare Fusion on my Macbook Pro that runs older versions of OS X (in this case 10.11). I need to test out the effects of installing and using some software. In doing so, I took snapshots in the virtual machine along the way. I now need to forensically analyze the changes to the VM at each stage of the process. How can I load and "diff" the VM and snapshots most effectively in EnCase?
Thank you in advance for your assistance!