We were victimized ransomware but was able to extract the partitions as IMG files from the VHDX file. As the VHDX file is encrypted I need to rejoin the 4 IMG files (partitions) to create a new VHD or VHDX file.
I was able to extract the contents of the VHDX file (with 7zip) and i extracted me 5 IMG files (each being one partition of the VHDX). with 7Zip i am able to access the content of all the partitions, but the problem is that one of the partitions used to be a shared drive to the host system that was infected with the ramsomware, so that partition is also encrypted but i have access to the files, (just cannot open them).
as that VHDX used to be a whole WINDOWS 2016 server, which add shadow copies activated, and as the main system partitions were not encrypted i would like now to be able to rejoin all the IMG into a VHDX file so i can reconnect it to HYPER-V (or another virtualizer) in order go access the main system shadow copies and revert the encrypt of that partiton (share).