# ESXi Forensics

- [Mount external USB device in ESXi hypervisor](/esxi-forensics/mount-external-usb-device-in-esxi-hypervisor.md): How to mount an external USB drive in an ESXi hypervisor for host access. I highly recommend using a new, large disk (depending on your requirements) which will be formatted using VMFS/VMFS6.
- [Understanding ESXi](/esxi-forensics/understanding-esxi.md)
- [Partitions / Volumes](/esxi-forensics/understanding-esxi/partitions-volumes.md)
- [ESXi console / shell](/esxi-forensics/understanding-esxi/esxi-console-shell.md)
- [Guest Virtual Machines](/esxi-forensics/understanding-esxi/guest-virtual-machines.md)
- [General Notes](/esxi-forensics/general-notes.md)
- [Triage and Imaging](/esxi-forensics/triage-and-imaging.md)
- [ESXi VMFS Exploration](/esxi-forensics/esxi-vmfs-exploration.md): Scenario: Provided with E01 of disks from an ESXi server. You need to examine the files contained within a guest VM which was hosted on the ESXi server.
- [Export OVF from ESXi using OVF Tool](/esxi-forensics/export-ovf-from-esxi-using-ovf-tool.md): Sometimes you may not have access to the underlying datastore connected to an ESXi instance or vSphere cluster. Use OVF Tool to export an OVF of your required virtual machine
- [Identification, acquisition, and examination of iSCSI LUNs and VMFS datastores](/esxi-forensics/identification-acquisition-and-examination-of-iscsi-luns-and-vmfs-datastores.md)