> For the complete documentation index, see [llms.txt](https://www.iblue.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.iblue.team/esxi-forensics.md).

# ESXi Forensics

- [Mount external USB device in ESXi hypervisor](https://www.iblue.team/esxi-forensics/mount-external-usb-device-in-esxi-hypervisor.md): How to mount an external USB drive in an ESXi hypervisor for host access. I highly recommend using a new, large disk (depending on your requirements) which will be formatted using VMFS/VMFS6.
- [Understanding ESXi](https://www.iblue.team/esxi-forensics/understanding-esxi.md)
- [Partitions / Volumes](https://www.iblue.team/esxi-forensics/understanding-esxi/partitions-volumes.md)
- [ESXi console / shell](https://www.iblue.team/esxi-forensics/understanding-esxi/esxi-console-shell.md)
- [Guest Virtual Machines](https://www.iblue.team/esxi-forensics/understanding-esxi/guest-virtual-machines.md)
- [General Notes](https://www.iblue.team/esxi-forensics/general-notes.md)
- [Triage and Imaging](https://www.iblue.team/esxi-forensics/triage-and-imaging.md)
- [ESXi VMFS Exploration](https://www.iblue.team/esxi-forensics/esxi-vmfs-exploration.md): Scenario: Provided with E01 of disks from an ESXi server. You need to examine the files contained within a guest VM which was hosted on the ESXi server.
- [Export OVF from ESXi using OVF Tool](https://www.iblue.team/esxi-forensics/export-ovf-from-esxi-using-ovf-tool.md): Sometimes you may not have access to the underlying datastore connected to an ESXi instance or vSphere cluster. Use OVF Tool to export an OVF of your required virtual machine
- [Identification, acquisition, and examination of iSCSI LUNs and VMFS datastores](https://www.iblue.team/esxi-forensics/identification-acquisition-and-examination-of-iscsi-luns-and-vmfs-datastores.md)