You shouldn't get the image, they are already there on your vmware repos. You need only investigate them.
It is best possible if you set up (or use a soon created) virtual machine. So:
- stop the comporomised VMs
- get away their disks
- give them to your investigating/service VM
- check everything from it.
Luns haven't anything with them to do, they are only part of the virtual SCSI emulation of the vmware. They doesn't really matter, what really matters are the disk images on your system.
There is also a possibility, if you need to investigate a whole vmware system. In this case, the things are a little bit complexer, although I don't think that a vmware server could be really corrupted.
In this case I handled the vmware physical disks as normal disks (so I copied an image from them), extracted the .vmdk images from them, and used them. So, the image creation has a two-stage process:
- extract the vmware .vmdk disks from the vmware repos,
- analyse their content.
Here can a little trouble come in the picture, and this is that vmware uses vmfs filesystem for the vmdk images. But this vmfs can be processed by tools freely downloaddable from vmware.com.