Load history from a forensic image

BHE does not directly support the parsing of forensic image files therefore you will need to mount the forensic image first. In order to make Volume Shadow Copies accessible we recommend using Arsenal Image Mounter which can be licenced or used in "Free Mode".

Once the image is mounted go to File > Capture History, and select Capture history from logical drive.

You can then enter the path to the Windows user profile within the mounted drive, and the path to save the captured data to.

Once the capture is complete you will be prompted to load the history automatically into BHE.