Investigation Scenario 🔎 While reviewing the ESXi hostd.log, an analyst spots a network file connection referencing a known VM disk, but at an unexpected path different from where it typically runs from: /vmfs/volumes/BackupDS/temp/Finance01.vmdk The production VMDK still exists in its normal datastore, but it no longer exists in the referenced path. What do you look for to investigate whether an incident occurred? #InvestigationPath #DFIR #SOC