At http://computer-forensics.sans.org/community/downloads there is a free specialised tool for imaging suspect PCs and exmining the image running under VMWare.