How to convert a Parallels Disk Image with qemu-img for forensics analysis with Autopsy
From HDS to RAW
In a previous post i have explained how to convert a VMWare disk image (VMDK) into a RAW format useful for import into a forensics tool like Autopsy.
The same method can be used to convert a disk image created with Parallels (.hds), with this syntax:
qemu-img convert -f parallels original.hds -O raw converted.raw
That’s it! 🙂