Which forensic software platforms offer the most robust support for decrypting and mounting encrypted virtual machine images during an eDiscovery process?

When dealing with encrypted virtual machine (VM) images (such as VMware .vmdk , Hyper-V .vhdx , or raw disk formats protected by BitLocker, VeraCrypt/TrueCrypt, or FileVault), standard eDiscovery platforms often stall out without specialized helper tools or specialized forensic suites.arsenalrecon.com+1

The most robust approach usually involves a combination of specialized mounting/virtualization engines and all-in-one DFIR/eDiscovery processing suites.

Top Platforms & Tools for Encrypted VM Images

• Arsenal Image Mounter (AIM) : Widely considered the gold standard for mounting disk and VM images with virtualization capabilities. AIM mounts forensic images (including raw, E01, and VM formats) as fully integrated SCSI devices in Windows with complete SCSI pass-through. Crucially, it handles complex disk encryption (like BitLocker) and can launch a mounted image directly as a virtual machine (complete with live RAM context or bypass features like DPAPI credential extraction). This allows you to interact with the encrypted environment natively if keys or credentials are recovered.arsenalrecon.com+1
• Magnet AXIOM : Excellent for automated processing and ingestion of containerized and virtual disk structures (.vhd, .vhdx, .vmdk ). AXIOM Process includes native decryption modules that handle common volume-level encryptions (BitLocker, TrueCrypt, PGP) seamlessly during ingestion—provided you have the recovery key, password, or token. Its reporting and eDiscovery keyword-search functionality make sorting through the unmounted/decrypted artifact data intuitive.magnetforensics.com+1
• Passware Kit Forensic : Essential if you don't actually have the password or recovery key for the encrypted VM container. Passware specializes in breaking encryption on virtual machine disks, hypervisor-level security, and file-level stores (e.g., recovering BitLocker keys, VMWare encryption passwords, or Elcomsoft-style companion workflows). Once keys are cracked or recovered via Passware, the image can be exported or mounted in secondary tools.vmblog.com
• OpenText EnCase Forensic / Exterro FTK : Enterprise heavyweights that ingest raw VM formats and virtual containers natively. They handle volume-level decryption when credentials or escrow keys are supplied. While they lack the instant "live virtual machine launch" elegance of Arsenal Image Mounter, they offer enterprise-grade artifact parsing, indexing, and legal chain-of-custody tracking required for formal eDiscovery productions.
• X-Ways Forensics : Highly praised by advanced examiners for its speed and low overhead. X-Ways handles multi-partition and complex container mounting efficiently, though it requires valid credentials or external keys to process encrypted logical volumes rather than attempting brute-force recovery.cyberforensicacademy.com

Recommended Workflow Strategy

1. Password Recovery / Key Escrow: If the VM encryption key is unknown, run the image through Passware Kit Forensic or ElcomSoft Distributed Password Recovery to extract credentials or brute-force the container password.vmblog.com
2. Mounting & Virtualization: Use Arsenal Image Mounter to mount the decrypted or key-unlocked VM image with write-temporary protection, leveraging its direct VM-launch capabilities if you need to run the environment dynamically to bypass DPAPI or see live application states.arsenalrecon.com+1
3. Processing & eDiscovery Culling: Ingest the processed mount or container into Magnet AXIOM or your primary eDiscovery review platform to index communications, documents, and logs across the entire virtual file system.

If you'd like to narrow this down, let me know:

• What encryption type (BitLocker, AES-256, custom hypervisor encryption) are you facing?
• Do you already have the password/recovery keys , or do you need a tool to recover/crack them first?

For eDiscovery involving encrypted VM disks, the strongest options are generally Magnet AXIOM, OpenText Forensic (formerly EnCase), FTK, and X-Ways Forensics. The important distinction is that VM-image support and decryption support are separate capabilities: a platform may parse/mount VMDK/VHDX/VDI files but still require a password, recovery key, or separate decryption product.

Platform	VM-image support	Encryption/decryption	Mount/analyze workflow	eDiscovery fit
Magnet AXIOM / AXIOM Cyber	VMware, Hyper-V, VirtualBox and other VM images	Strong: BitLocker, FileVault, TrueCrypt/VeraCrypt and several enterprise encryption schemes; Passware integration	Strong forensic parsing and examination of VM contents	Very strong
OpenText Forensic (EnCase)	Broad forensic-image support; VM workflows available	Strong historical encryption support; EnCase has supported disk/volume and file decryption, with Passware integration	Strong evidentiary preservation and forensic analysis	Very strong
FTK	VMDK, VHD/VHDX, VDI and numerous forensic-image formats	Strong enterprise/full-disk encryption recognition; generally requires credentials/keys rather than "cracking"	Strong indexing/search and forensic examination	Very strong for large eDiscovery datasets
X-Ways Forensics	Broad VM and disk-image support	Strong BitLocker and other filesystem-level encryption capabilities; particularly good when keys are available	Excellent low-level examination and mounting	Very strong for forensic-heavy workflows
Belkasoft X Forensic	VMware, Hyper-V/Virtual PC, VirtualBox, XenServer	Broad encryption capabilities, depending on source and credentials	Good VM and filesystem examination	Strong alternative

The key distinction: "decrypt" vs. "mount"

For an encrypted VM, there are usually two layers:

1. The VM container — e.g., VMDK, VHDX, or VDI.
2. The guest OS's encrypted volume — e.g., BitLocker inside a Windows VM.

A platform can successfully open the VMDK while still being unable to access the guest filesystem until you supply the BitLocker recovery key/password. Magnet's documentation, for example, explicitly lists support for VM image formats and multiple encryption technologies, while noting that known passwords/recovery keys may be required.Magnet Forensics+1

How I'd differentiate the major platforms

Magnet AXIOM Cyber is particularly interesting for eDiscovery because Magnet explicitly describes a workflow in which VM disk images from VMware, Hyper-V and VirtualBox can be brought into an investigation alongside endpoints, cloud sources and removable media. Magnet Forensics Its encryption support includes BitLocker, FileVault, TrueCrypt/VeraCrypt and several enterprise products, with Passware-related capabilities for decryption.Magnet Forensics

OpenText Forensic is the current name for what was EnCase Forensic; OpenText says the product was renamed rather than replaced. It supports encrypted volumes and broad computer/storage evidence, and the older EnCase documentation specifically describes disk/volume decryption and Passware integration.OpenText+1

FTK has particularly broad image-format coverage: its documentation explicitly lists VMware VMDK, Microsoft VHD, VirtualBox VDI and numerous forensic image formats. Its encryption documentation also makes an important forensic distinction: supported whole-disk encryption products can be decrypted when the investigator supplies the required credentials; AccessData/FTK isn't presented as simply "cracking" those products.Exterro

X-Ways Forensics is worth considering when your workflow needs very granular filesystem-level control. Recent X-Ways documentation, for example, describes internal BitLocker decryption using available .BEK startup keys and support for additional filesystems inside BitLocker volumes.X-Ways

Belkasoft X Forensic is another capable option: its current specifications explicitly list VMware, Hyper-V, VirtualBox and XenServer VM sources alongside E01, AFF4, DD, X-Ways and other forensic formats.Belkasoft

For an eDiscovery deployment

If your primary requirement is "take an encrypted VMDK/VHDX, use a legally defensible key/password, expose the guest filesystem, then search/cull/export responsive material," I'd pay particular attention to these capabilities rather than simply looking for the longest encryption-support list:

• VM format coverage: VMDK, VHD/VHDX, VDI, snapshots and split disks.
• Nested encryption: ability to handle BitLocker/FileVault/etc. inside the VM.
• Key handling: recovery keys, BEK files, TPM-derived material, passwords and Passware integration.
• Read-only mounting: preservation of evidence while exposing the guest filesystem.
• Large-scale indexing: essential when the VM contains hundreds of GB or millions of files.
• Deduplication and hashing: particularly important when moving extracted data into an eDiscovery review platform.
• Export fidelity: timestamps, deleted files, filesystem metadata and provenance should survive the handoff.
• Audit trail/chain of custody: especially important if the resulting evidence may later be challenged.

One especially useful architecture is forensic processing → decryption/mounting → targeted extraction/culling → eDiscovery review platform, rather than trying to make the review platform itself understand every encrypted VM format.

If you tell me which VM/encryption combinations you're dealing with (for example VMware VMDK + BitLocker, Hyper-V VHDX + BitLocker, or encrypted VMware VMFS/datastore), I can give you a more precise capability matrix for AXIOM vs FTK vs OpenText vs X-Ways, including which ones can actually decrypt/mount each combination and what key material they require.

X-Ways Forensics is worth considering when your workflow needs very granular filesystem-level control. Recent X-Ways documentation, for example, describes internal BitLocker decryption using available .BEK startup keys and support for additional filesystems inside BitLocker volumes.x-ways.net

Belkasoft X Forensic is another capable option: its current specifications explicitly list VMware, Hyper-V, VirtualBox and XenServer VM sources alongside E01, AFF4, DD, X-Ways and other forensic formats.belkasoft.com

For an eDiscovery deployment

If your primary requirement is "take an encrypted VMDK/VHDX, use a legally defensible key/password, expose the guest filesystem, then search/cull/export responsive material," I'd pay particular attention to these capabilities rather than simply looking for the longest encryption-support list:

When handling encrypted virtual machine (VM) images (.vmdk .vmdk.v m d k, .vhd .vhd.v h d, .vhdx .vhdx.v h d x, .vdi .vdi.v d i ) during an eDiscovery or digital forensics and incident response (DFIR) workflow, the goal is defensible decryption, seamless mounting , and deep artifact parsing.

The leading forensic software platforms that offer robust, court-admissible support for these tasks are categorized below:

• Magnet AXIOM / AXIOM Cyber : Highly regarded for its integrated processing capabilities. When dealing with encrypted VM disk containers or internal partitions (supporting BitLocker, VeraCrypt, TrueCrypt, and PGP), AXIOM Process seamlessly prompts for known passwords or recovery keys. It handles standard VM image formats directly as evidence sources, parsing artifacts without requiring an external mounting utility. Learn more about its capabilities on the Magnet AXIOM platform.youtube.com+1
• OpenText EnCase Forensic : Long considered an enterprise gold standard for deep, low-level disk analysis and legal defensibility. EnCase natively handles complex disk structures, virtual machine formats, and various encryption schemes (including BitLocker, FileVault, and PGP). Its mounting engine allows investigators to map virtual images and decrypted volumes as local drive letters, preserving full chain-of-custody logs required for strict eDiscovery productions. Explore features via OpenText EnCase Forensic.blogs.opentext.com
• Belkasoft X : Offers exceptional built-in support for virtual machines and popular encryption formats. Belkasoft X can ingest raw or hypervisor-specific VM disk images, automatically detect encrypted containers or volumes, and—provided the credentials, RAM dump, or recovery keys are supplied—decrypt and parse them out-of-the-box for eDiscovery workflows. Check out details on Belkasoft X.belkasoft.com
• X-Ways Forensics : Known for its blazing-fast processing speed and ultra-low RAM footprint. X-Ways excels at mounting raw and containerized disk images (including VM exports) and interpreting various file systems on the fly. While it is more manual regarding password recovery compared to automated suites, its direct handling of sector-level data makes it a favorite for dissecting complex or non-standard encrypted VM structures.magnetforensics.com
• Autopsy (with Sleuth Kit) : An open-source alternative that handles standard VM files (.vmdk or .vhd ) as a "Disk Image or VM File". While native decryption support for heavy enterprise encryption within Autopsy is limited compared to commercial suites (often requiring external helper utilities like cryptsetup or specialized decryption before deep ingestion), its extensibility via modules makes it a viable budget-conscious or supplementary tool.medium.com+1

If you'd like to narrow this down, let me know:

• What hypervisor format are you working with (VMware .vmdk .vmdk.v m d k , Hyper-V .vhdx .vhdx.v h d x , etc.)?
• What encryption method is applied (BitLocker, AES-NI, LUKS, etc.) and do you have the password/recovery key or need to perform password recovery?

When dealing with encrypted virtual machine images (such as BitLocker-encrypted VHD/VHDX, VMware VMDK, or FileVault-protected disk structures) during an eDiscovery or digital forensics and incident response (DFIR) workflow, robustness depends on two main capabilities: seamless parsing/decryption integration (often via built-in keys or Passware/Elcomsoft bridges) and the ability to mount or spin up the image for dynamic analysis.

The software platforms that offer the most robust end-to-end support for these requirements include:

• Magnet AXIOM (with Passware Integration): Magnet AXIOM features native processing integration with Passware to handle full disk decryption (FDD). When presented with an encrypted virtual machine container or disk image (VHD/VHDX or raw formats secured by BitLocker, VeraCrypt, or PGP), AXIOM prompts for the known password or recovery/key file, decrypts the structure on-the-fly during the ingest phase, and parses artifacts without requiring a separate manual mount step.youtube.com
• OpenText EnCase Forensic: EnCase remains an enterprise gold standard for handling complex and encrypted file systems. When loaded with an encrypted image or virtual disk, EnCase natively prompts for credentials (such as BitLocker passwords/recovery keys or FileVault hashes) to interpret and mount the underlying file structure. For live virtualization needs, many examiners pair EnCase with specialized boot/virtualization utilities like Virtual Forensic Computer (VFC) to instantly spin an image into a functional virtual machine.reddit.com
• AccessData FTK / Exadecase / Exterro FTK: FTK includes robust handling for container and volume-level encryption. If the recovery key or password is provided—or if an enterprise token/key escrow is available—FTK decrypts and indexes the logical partitions automatically, allowing investigators to mount and search the virtual evidence cleanly within the review pipeline.
• Belkasoft X: Belkasoft X provides exceptional built-in support for analyzing virtual machine formats (VMDK, VHD, VHDX) and natively handles whole-disk encryption (BitLocker, PGP, VeraCrypt, and FileVault). It can automatically parse encrypted containers if credentials or RAM captures containing decryption keys are provided to the case.
• Elcomsoft Encrypted Disk Hunter & Forensic Disk Decrypter: While not full eDiscovery review suites, Elcomsoft tools act as critical companion utilities. They specialize in detecting, extracting, and instantly mounting encrypted virtual volumes and containers, bridging the gap when standard eDiscovery platforms stall on exotic or heavily protected enterprise VM setups.elcomsoft.com

To help me narrow down the best platform recommendation for your exact workflow, could you share:

• What virtualization format and encryption standard (e.g., BitLocker-encrypted VHDX, LUKS-encrypted raw image) are you dealing with?
• Do you have access to the cleartext password/recovery keys , or do you need password recovery/brute-forcing capabilities included?

For an eDiscovery workflow involving encrypted VMware/Hyper-V/VirtualBox images, the strongest options are generally Magnet AXIOM, Exterro FTK, OpenText Forensic (formerly EnCase), and UFS Explorer. The important distinction is that supporting an encrypted VM image can mean either recognizing/mounting the virtual disk, decrypting the guest volume, or actually recovering the encryption credential. Those are different capabilities.

The standout choices

Magnet AXIOM is particularly compelling when the VM is only one component of a broader eDiscovery/investigation. Its documentation explicitly lists VM formats including VDI, VHD/VHDX and VMDK, and its encryption capabilities include BitLocker, FileVault, TrueCrypt, VeraCrypt, PGP and other schemes. Magnet also documents Passware integration for encrypted drives.Magnet Forensics+1

magnetforensics.com

Exterro FTK is another strong choice. Its documentation explicitly lists VMware VMDK, Microsoft VHD, VirtualBox VDI and numerous other VM/image formats. It also documents recognition/decryption of a substantial range of whole-disk encryption products, while making clear that FTK itself does not simply "crack" those encryption schemes—the investigator generally supplies the necessary credential/key.Exterro

exterro.com

OpenText Forensic (EnCase) is especially interesting for organizations already using EnCase-style forensic workflows. OpenText says the current product is the same technology formerly sold as EnCase Forensic and supports encrypted volumes as well as Windows, macOS and Linux evidence. Its historical documentation also describes the EnCase Decryption Suite and Passware integration.OpenText+1

opentext.com

UFS Explorer deserves special consideration if the central problem is encrypted virtual disks themselves. Its current feature comparison explicitly lists VMware VMDK, Hyper-V VHD/VHDX, QEMU QCOW/QCOW2 and VirtualBox VDI, and—unusually explicitly—encrypted VMDK virtual disks, alongside BitLocker, FileVault, LUKS, TrueCrypt and VeraCrypt.UFS Explorer

ufsexplorer.com

One important caveat

If by "decrypting" you mean recovering a lost VMware VM encryption key or password, rather than decrypting a guest OS volume for which you have a BitLocker recovery key/password, the comparison changes substantially. Most forensic platforms are designed to use known credentials/recovery keys, not defeat modern VM encryption cryptographically.

For example, Microsoft confirms that BitLocker can be used inside VMs, while Magnet's documentation specifically notes cases where a recovery key is required rather than merely the user's password.Microsoft Learn+1

For purely mounting and examining encrypted VMDKs, I'd put UFS Explorer and Magnet AXIOM near the top of the shortlist. For a full eDiscovery case platform, I'd focus the evaluation on AXIOM vs. FTK vs. OpenText Forensic, with UFS Explorer potentially serving as a specialist VM/disk-handling companion.

If you tell me whether you're dealing primarily with VMware VMDK, Hyper-V VHDX, or VirtualBox VDI, and whether the encryption is VM-level encryption or BitLocker/FileVault inside the guest, I can give you a more precise feature-by-feature comparison.

If the requirement is specifically eDiscovery/forensic examination of encrypted VM disks—for example VMDK, VHD/VHDX, VDI, or QCOW2—the strongest options are not necessarily the same as the best general eDiscovery review platforms.

Best options

Platform	VM image support	Encryption/decryption	Forensic mounting	eDiscovery suitability
X-Ways Forensics	Strong	Strong, often via integrated/companion tools	Excellent	High
OpenText Forensic (formerly EnCase)	Strong	Very strong	Excellent	High
FTK / FTK Imager Pro	VMDK, VHD, VDI and major forensic formats	Strong for supported volume encryption; password/key dependent	Excellent	Very high
GetData Mount Image Pro + Forensic Explorer	VMDK, VHD/VHDX, VDI and forensic images	BitLocker/FileVault when credentials are available	Excellent	High
Passware Kit + a forensic platform	Works particularly well with forensic images	Excellent encryption/decryption breadth	Usually paired with another tool for mounting	High
Arsenal Image Mounter	VMDK, VHD/VHDX, VDI, QCOW/QCOW2, OVA, etc.	Good for unlocked/decryptable images	Excellent	Medium; best as a mounting component

My practical ranking

1. FTK ecosystem — best overall for eDiscovery-oriented workflows. FTK supports VMDK and VDI among its recognized disk-image formats, as well as VHD, E01/Ex01, RAW and others. Its documentation also identifies numerous whole-disk encryption products, including BitLocker, FileVault, PGP, McAfee, Symantec and others.Exterro+1

2. OpenText Forensic — best for broad forensic/decryption coverage. OpenText Forensic is the current name for EnCase Forensic. OpenText explicitly describes support for encrypted volumes and broad OS/filesystem coverage, while the historical EnCase Decryption Suite supported disk/volume and file-based encryption and could integrate with Passware.OpenText+1

3. X-Ways Forensics — best lightweight/high-control forensic option. X-Ways is particularly attractive when examiners need granular control over evidence containers, filesystems, metadata and forensic processing. It also has broad filesystem and evidence-format support.X-Ways+1

4. GetData Mount Image Pro — arguably the best dedicated mounting utility. This is particularly compelling if your question is literally “How do I safely mount an encrypted VM disk so another forensic/eDiscovery application can inspect it?” It directly supports VMDK, VHD/VHDX, E01/Ex01, AFF/AFF4 and other formats, with read-only mounting and BitLocker/FileVault access when the password is known.GetData Forensics

5. Passware Kit — best specialist decryption companion. Passware is less of an all-in-one forensic examiner than a decryption engine. Its current documentation says its forensic/business editions can decrypt E01 and AFF4 images protected with BitLocker, TrueCrypt, VeraCrypt, FileVault 2, LUKS/LUKS2, McAfee, PGP WDE and Symantec Endpoint Encryption.Passware Support

6. Arsenal Image Mounter — excellent when mounting is the central problem. It can expose VMDK, VHD/VHDX, VDI, XVA, OVA and QCOW/QCOW2 images to Windows as disk devices, alongside traditional forensic formats such as E01 and AFF4. It's particularly useful as an imaging/mounting layer underneath other forensic applications.Arsenal Recon

The important distinction

There are really three separate capabilities you should evaluate:

1. VM-container support — Can it parse VMDK/VHDX/VDI/QCOW2 and snapshots?
2. Encryption support — Can it unlock the encryption, assuming you have a password, recovery key, token, or other authorized credential?
3. Forensically sound mounting — Can it expose the decrypted filesystem read-only or through an overlay without altering evidence?

No single product is necessarily best at all three. For example, Passware + FTK/OpenText/X-Ways can be considerably more capable than relying on the native decryption functionality of a single platform.

For an eDiscovery environment, I'd generally shortlist FTK, OpenText Forensic, and X-Ways, then add Passware if encrypted VMs are a recurring problem. If the operational requirement is primarily mounting VM images for downstream review, Mount Image Pro or Arsenal Image Mounter deserves serious consideration.

One caveat: these products generally do not magically defeat modern encryption. Their effectiveness depends on having an authorized password/recovery key, accessible encryption metadata/keys, or a supported password-recovery workflow. FTK's documentation, for example, explicitly notes that its WDE workflows require the investigator to provide the password rather than “crack” the encryption.Exterro

If you tell me whether you're dealing primarily with VMware VMDK, Hyper-V VHDX, VirtualBox VDI, or cloud VM snapshots, I can narrow this to the best 2–3 platforms and compare encryption algorithms, snapshots, BitLocker/VeraCrypt/LUKS support, read-only mounting, deduplication, and eDiscovery export.

4. GetData Mount Image Pro — arguably the best dedicated mounting utility. This is particularly compelling if your question is literally “How do I safely mount an encrypted VM disk so another forensic/eDiscovery application can inspect it?” It directly supports VMDK, VHD/VHDX, E01/Ex01, AFF/AFF4 and other formats, with read-only mounting and BitLocker/FileVault access when the password is known.GetData Forensics

5. Passware Kit — best specialist decryption companion. Passware is less of an all-in-one forensic examiner than a decryption engine. Its current documentation says its forensic/business editions can decrypt E01 and AFF4 images protected with BitLocker, TrueCrypt, VeraCrypt, FileVault 2, LUKS/LUKS2, McAfee, PGP WDE and Symantec Endpoint Encryption.support.passware.com

6. Arsenal Image Mounter — excellent when mounting is the central problem. It can expose VMDK, VHD/VHDX, VDI, XVA, OVA and QCOW/QCOW2 images to Windows as disk devices, alongside traditional forensic formats such as E01 and AFF4. It's particularly useful as an imaging/mounting layer underneath other forensic applications.

The important distinction

There are really three separate capabilities you should evaluate:

When dealing with encrypted virtual machine images (such as BitLocker-encrypted VHD/VHDX, VeraCrypt containers inside VMDKs, or FileVault-encrypted macOS virtual disks) during an eDiscovery or digital forensics process, robustness relies on three core capabilities: automated parsing of hypervisor formats, integrated decryption (password/recovery key/token handling) , and forensically sound mounting/processing.

The industry-standard software platforms providing the most robust support for these workflows include:

• Exterro FTK (Forensic Toolkit) : Long recognized as an enterprise workhorse for deep data visibility, FTK features robust built-in decryption engines (leveraging integrated password recovery and key management, including pass-through for BitLocker, PGP, and other enterprise encryption standards). It natively ingests various virtual machine image formats (VMDK, VHD, VHDX) and seamlessly processes them once the partition/volume layer is decrypted, maintaining strict chain-of-custody logging required for legal defensibility.
• OpenText EnCase Forensic : Regarded globally as a legal gold standard, EnCase treats complex disk structures and virtual images with high fidelity. It allows investigators to map virtual disks directly without full physical restoration, handles standard container and volume-level decryption gracefully through credential/key input, and parses complex file systems embedded within virtual containers efficiently for eDiscovery review.
• Magnet AXIOM / AXIOM Cyber : Particularly strong in handling modern data artifacts, AXIOM Cyber integrates advanced decryption capabilities (often utilizing robust internal processing or third-party hooks like Passware) to automatically attempt decryption of encrypted volumes during ingestion. It excels at parsing enterprise cloud and endpoint virtual environments, mapping out file systems from mounted or ingested VM images cleanly into an intuitive review pane.
• X-Ways Forensics : For analysts who prefer low-level, high-speed disk examination, X-Ways handles raw and containerized virtual images with minimal overhead. While it relies heavily on the investigator supplying known keys, passwords, or RAM-captured decryption material (via integrations or external tools like cryptsetup ), its ability to parse through complex sector offsets and handle massive logical structures inside virtual disks is unmatched.
• Elcomsoft Encrypted Disk Hunter (EEDH) / Forensic Disk Decryptor : Frequently used as a specialized companion utility, Elcomsoft tools specialize in locating, mounting, and instantly decrypting protected volumes or virtual machine containers by harvesting keys from memory dumps or hibernation files if a live or semi-live acquisition was performed.

If you can share what specific hypervisor format (VMDK, VHDX, QCOW2) and encryption type (BitLocker, LUKS, VeraCrypt) you are targeting, I can provide a more tailored step-by-step workflow or recommend the most efficient tool configuration.

When dealing with encrypted virtual machine (VM) images (such as .vhd, .vhdx, .vmdk , or raw dd/E01 exports of VM disks) in an eDiscovery or digital forensics workflow, "robust support" means more than just entering a password. It requires handling volume-level encryption (BitLocker, LUKS, FileVault), enterprise full-disk encryption (FDE) agents (McAfee, PGP), and the capacity to mount the storage subsystem with SCSI/IDE virtualization integrity intact—preferably with write-blocking or write-temporary safety.elcomsoft.com+3

The industry-leading platforms and tools offering the most robust capabilities for decrypting and mounting encrypted VM images span specialized mounting drivers and comprehensive eDiscovery/forensic suites:

1. Arsenal Image Mounter (AIM) — Best for In-Depth Mounting & Pre-Boot FDE Interaction

• How it works: Arsenal Image Mounter attaches disk images and virtual machine disks (like VMDKs or VHDs) as genuine SCSI disks within Windows, rather than just virtual folders. Crucially, it integrates with Microsoft Hyper-V to actually launch encrypted disk images into a virtual machine.arsenalrecon.com+2
• eDiscovery/Forensic Strengths: If an enterprise FDE solution or complex password/token protection prevents standard parsing, AIM lets you boot the image into its pre-boot authentication (PBA) environment. It handles BitLocker, LUKS, and various enterprise encryptions gracefully through temporary write-activation, live unlocking, or complete volume decryption.arsenalrecon.com+3

2. Magnet AXIOM — Best for Integrated Processing & Direct Container Support

• How it works: Magnet AXIOM natively accepts virtual machine containers (.vhd, .vhdx, .vmdk ) as direct evidence sources. If the volume is encrypted with common standards like BitLocker, VeraCrypt/TrueCrypt, or PGP, AXIOM flags it and prompts for the known recovery key, password, or XML token during the ingestion phase.youtube.com+1
• eDiscovery/Forensic Strengths: Rather than requiring an external multi-step decryption routine, AXIOM automatically parses and extracts artifacts on-the-fly once the decryption credential is provided, streamlining the transition from raw locked image to searchable eDiscovery database in AXIOM Examine.youtube.com+1

3. OpenText EnCase Forensic / EnCase eDiscovery — Best for Enterprise Scale & Scripted Decryption

• How it works: EnCase natively handles major virtual disk formats and incorporates robust decryption modules for standard container formats and corporate key-management solutions (such as imported XML recovery keys for McAfee/Symantec endpoint encryption).reddit.com
• eDiscovery/Forensic Strengths: EnCase excels when processing large-scale corporate custodian VM backups. It allows legal/forensic teams to input escrowed recovery keys at the case-setup level, performing bulk decryption or logical mounting across massive virtual architectures while preserving chain-of-custody logging.

4. Elcomsoft Forensic Disk Decryptor (EFDD) & Passware Kit Forensic — Best Auxiliary Decryption Engines

• How it works: While not standalone eDiscovery review platforms, Elcomsoft Forensic Disk Decryptor and Passware Kit Forensic are critical companion utilities. EFDD extracts encryption metadata from BitLocker, LUKS, FileVault, and PGP containers to instantly mount or decrypt images, while Passware handles brute-force/dictionary acceleration via GPU/cloud infrastructure if the password is unknown.passware.com+2
• eDiscovery/Forensic Strengths: They bridge the gap when credentials are missing or when primary eDiscovery tools fail to recognize proprietary FDE metadata layers on custom VM configurations.

Comparison at a Glance

• Arsenal Image Mounter: Unmatched for structural mounting, virtual machine launching, and handling stubborn pre-boot FDE environments.
• Magnet AXIOM: Ideal for end-to-end processing, artifact parsing, and ease-of-use once a password or recovery key is secured.
• EnCase: Preferred for large corporate eDiscovery environments utilizing centralized key escrow (BitLocker/McAfee/PGP enterprise management).arsenalrecon.com+3

If you have a specific type of encryption (e.g., BitLocker with TPM, enterprise McAfee, LUKS) or a particular virtual disk format (.vmdk vs .vhdx), let me know and I can detail the exact workflow steps for that configuration.

For an eDiscovery workflow involving encrypted VM images, I’d separate the problem into two capabilities: (1) decrypting the encrypted virtual disk and (2) mounting/forensically accessing the resulting VMDK/VHD/VHDX/VDI without altering evidence.

Strongest options

Platform	Encrypted VM support	Mounting / VM-image support	Best fit
UFS Explorer	Excellent — explicitly supports encrypted VMware VMDKs plus BitLocker, FileVault/APFS, LUKS, TrueCrypt/VeraCrypt	Excellent — VMDK, VHD/VHDX, VDI, QCOW/QCOW2, etc.	Best specialist choice for encrypted VM disks
Magnet AXIOM	Excellent — BitLocker, TrueCrypt, VeraCrypt, FileVault and other encryption workflows, with Passware integration	Very good — supports VMDK, VHD/VHDX, VDI and other VM sources	Best end-to-end forensic investigation platform
X-Ways Forensics	Very good — extensive filesystem/encryption capabilities; recent versions add BitLocker startup-key handling	Excellent for forensic image/container examination	Best for examiner-level forensic control and efficiency
Exterro FTK	Very good — recognizes numerous whole-disk encryption technologies and supports VMDK/VHD/VDI	Excellent evidence processing/mounting ecosystem	Best for large-scale enterprise/eDiscovery processing
GetData Mount Image Pro	Good — BitLocker/FileVault when credentials are known	Excellent dedicated mounting tool, including VMDK, VHD/VHDX and forensic formats	Best as a dedicated mounting layer alongside another review platform
Belkasoft X Forensic	Good	Very good — VMware, Hyper-V, VirtualBox and XenServer images	Good all-around alternative

My ranking for your particular use case

1. UFS Explorer — strongest for the actual encrypted VM problem. Its current feature matrix specifically lists encrypted VMDK virtual disks alongside BitLocker, FileVault 2, APFS encryption, LUKS, TrueCrypt and VeraCrypt. It also handles VMware VMDK, Hyper-V VHD/VHDX, VirtualBox VDI and QCOW/QCOW2.UFS Explorer

2. Magnet AXIOM — strongest integrated forensic platform. AXIOM supports virtual-machine evidence including VMDK/VHD/VHDX/VDI and has extensive encryption support. Its documentation specifically describes decryption support for technologies such as BitLocker, TrueCrypt, PGP, FileVault, McAfee and VeraCrypt, with Passware integration for password/recovery-key workflows.Magnet Forensics+1

3. X-Ways Forensics — excellent when forensic defensibility and low-level control matter most. X-Ways is particularly strong for working directly with forensic images and filesystem structures. Its recent releases have expanded BitLocker decryption—for example, it can automatically locate/use .BEK startup keys when available.X-Ways Software Technologies+1

4. FTK — particularly attractive in enterprise eDiscovery. FTK supports VMDK, VHD, VDI and numerous forensic image formats, while its encryption support covers a broad set of whole-disk encryption products. Exterro's documentation is explicit that these workflows generally require the investigator to supply the password/key rather than FTK "cracking" the encryption.Exterro

5. Mount Image Pro — excellent companion tool. If your principal requirement is "give me a defensible read-only drive-letter mount of this VMDK/VHD/E01 and let another application process it," this is particularly compelling. It supports VMDK, VHD/VHDX and numerous forensic formats and can mount read-only or use a cache to simulate writes.GetData Forensics

One important distinction

For eDiscovery, I'd avoid evaluating these solely on whether they say "supports VMDK." An ordinary VMDK and an encrypted VMware VMDK are substantially different problems.

If your scenario is something like:

Encrypted VMware VMDK → recover password/key → decrypt → mount read-only → preserve hashes/metadata → index/search in an eDiscovery platform then UFS Explorer + your existing eDiscovery platform is arguably the most specialized combination. If you want one forensic environment to do acquisition, decryption, artifact analysis and reporting, Magnet AXIOM or X-Ways are stronger candidates.

Also, decryption support generally means using a legitimately available password, recovery key, token, or other authorized credential—not bypassing the encryption.

If you tell me which VM format you have (VMDK, VHDX, VDI, QCOW2), encryption technology (VMware encryption, BitLocker inside the VM, VeraCrypt, etc.), and your eDiscovery backend (Relativity, Everlaw, DISCO, Nuix, etc.), I can narrow this to the best 2–3-tool workflow.