ATTENTION: The new home of the Digital Forensics Wiki is at https://forensicswiki.xyz/. Yeah, it's a silly name, but it was cheap.
This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn

VMWare from hard drive images

From ForensicsWiki
Revision as of 17:56, 23 March 2012 by Pmow (Talk | contribs) (added result picture)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search


Creating virtual machines from forensic images

After having no success with raw2vmdk, the Live View method has worked.

Live View requires:

-Java JRE

-VMWare Workstation 5.5+ or Server

-VMWare VDDK (download)

Install

Install prerequisites followed by Live View (the installer will check for pre-reqs).

Tested: Win7-64 with VMWare Workstation 7.12, Live View 0.7b, and VMWare VDDK 5.0


LiveView.png

VMX Creation

1. Run Live View as Administrator. (Messages pane will result in errors otherwise)

2. Set memory and OS as closely as possible to target machine specs. (To maximize probability of success)

3. Click "Start". (The screenshot error relates to maximums exceeded based on client machine.)

VMWareWorkstation.png