I’m in your hypervisor, collecting your evidence

Executive summary: This blog post describes Fox-IT's development of hypervisor data acquisition capabilities, detailing reverse engineering of VMware ESXi internals (VMFS, FAT16 bootbank, vmtar, Envelope encryption, filesystem mounting) and adding Hyper-V VMCX parsing into their Dissect/Acquire tooling to enable live and offline evidence collection from hypervisors; it notes limitations (local/iSCSI storage only) and emphasizes preservation, stealth, and scalability for DFIR workflows.