The exhume Body module is part of the exhume toolkit and is allowing you to examine, investigate and abstracting a body of data using different file formats.
The current supported formats are:
- RAW
- EWF
- VMDK
- AFF
- AFF4 (Cellebrite/MacQuisition implementation).
VMFSSparse (ESXi snapshots, delta files, linked clones) and full physical disk or partition-wide VMDK volumes are not supported. AFF4 parser still needs improvement to cover more implementations.
You can find the full installation and usage guide here: https://www.forensicxlab.com/docs/category/exhume---body