Live view - Revision history

.FUF: updated

2009-04-04T17:42:41Z

updated

Jessek: Added some links

2007-04-21T12:45:51Z

Added some links

Cal at 15:07, 27 March 2007

2007-03-27T15:07:32Z

Cal: Live View allows the forensic examiner to "boot up" the image or disk and gain an interactive, user-level perspective of the environment

2007-03-27T15:05:38Z

Live View allows the forensic examiner to "boot up" the image or disk and gain an interactive, user-level perspective of the environment

New page

Live View[http://liveview.sourceforge.net/] is a Java-based graphical forensics tool that creates a VMware virtual machine out of a raw (dd-style) disk image or physical disk. This allows the forensic examiner to "boot up" the image or disk and gain an interactive, user-level perspective of the environment, all without modifying the underlying image or disk. Because all changes made to the disk are written to a separate file, the examiner can instantly revert all of his or her changes back to the original pristine state of the disk. The end result is that one need not create extra "throw away" copies of the disk or image to create the virtual machine.

Live View is capable of booting

* Full disk raw images
* Bootable partition raw images
* Physical Disks (attached via a USB or Firewire bridge)

Containing the following operating systems

* Windows XP, 2000, 2003, NT, Me, 98
* Linux (limited support)

Behind the scenes, Live View automates a wide array of technical tasks. Some of these include: resolving hardware conflicts resulting from booting on hardware other than that on which the OS was originally installed; creating a customized MBR for partition-only images; and correctly specifying a virtual disk to match the original image or physical disk.

Live View is developed by CERT, Software Engineering Institute

← Older revision		Revision as of 15:07, 27 March 2007
Line 1:		Line 1:
−	Live View[http://liveview.sourceforge.net/] is a Java-based graphical forensics tool that creates a VMware virtual machine out of a raw (dd-style) disk image or physical disk. This allows the forensic examiner to "boot up" the image or disk and gain an interactive, user-level perspective of the environment, all without modifying the underlying image or disk. Because all changes made to the disk are written to a separate file, the examiner can instantly revert all of his or her changes back to the original pristine state of the disk. The end result is that one need not create extra "throw away" copies of the disk or image to create the virtual machine.	+	Live View[http://liveview.sourceforge.net/] is a Java-based graphical forensics tool that creates a VMware virtual machine out of a raw (dd-style) disk image or physical disk. This allows the forensic examiner to "boot up" the image or disk and gain an interactive, user-level perspective of the environment, all without modifying the underlying image or disk. Because all changes made to the disk are written to a separate file, the examiner can instantly revert all of his or her changes back to the original pristine state of the disk. The end result is that one need not create extra "throw away" copies of the disk or image to create the virtual machine.

	Live View is capable of booting		Live View is capable of booting

@@ Line 9: / Line 9: @@
 Containing the following operating systems
-* Windows XP, 2000, 2003, NT, Me, 98
+* Windows 2008, Vista, 2003, XP, 2000, NT, Me, 98
 * Linux (limited support)

@@ Line 1: / Line 1: @@
-Live View[http://liveview.sourceforge.net/] is a Java-based graphical forensics tool that creates a VMware virtual machine out of a raw (dd-style) disk image or physical disk. This allows the forensic examiner to "boot up" the image or disk and gain an interactive, user-level perspective of the environment, all without modifying the underlying image or disk. Because all changes made to the disk are written to a separate file, the examiner can instantly revert all of his or her changes back to the original pristine state of the disk. The end result is that one need not create extra "throw away" copies of the disk or image to create the virtual machine.
+Live View is a Java-based graphical forensics tool that creates a VMware virtual machine out of a [[raw image file]] or physical disk. This allows a forensic examiner to "boot up" the image or disk and gain an interactive, user-level perspective of the environment, all without modifying the underlying image or disk. Because all changes made to the disk are written to a separate file, the examiner can instantly revert all of his or her changes back to the original pristine state of the disk. The end result is that one need not create extra "throw away" copies of the disk or image to create the virtual machine.
 Live View is capable of booting
-    * Full disk raw images
+* Full disk raw images
-    * Bootable partition raw images
+* Bootable partition raw images
-    * Physical Disks (attached via a USB or Firewire bridge)
+* Physical Disks (attached via a USB or Firewire bridge)
 Containing the following operating systems
-    * Windows XP, 2000, 2003, NT, Me, 98
+* Windows XP, 2000, 2003, NT, Me, 98
-    * Linux (limited support)
+* Linux (limited support)
-Behind the scenes, Live View automates a wide array of technical tasks. Some of these include: resolving hardware conflicts resulting from booting on hardware other than that on which the OS was originally installed; creating a customized MBR for partition-only images; and correctly specifying a virtual disk to match the original image or physical disk.
+Behind the scenes, Live View automates a wide array of technical tasks. Some of these include: resolving hardware conflicts resulting from booting on hardware other than that on which the OS was originally installed; creating a customized [[master boot record]] for partition-only images; and correctly specifying a virtual disk to match the original image or physical disk.
 Live View is developed by CERT, Software Engineering Institute