Convert .e01 to run...
 
Notifications
Clear all

Convert .e01 to run on VMware

12 Posts
9 Users
0 Likes
7,287 Views
(@redusadaz)
Posts: 7
Active Member
Topic starter
 

All

I'm trying to convert my image to run on VMware, but don't appear to be having much luck, or there is an easier way. I am following these instructions

http//www.computerforensicsworld.com/modules.php?name=Forums&file=viewtopic&t=3049

 
Posted : 28/11/2012 5:37 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

Which method did you use? Several were discussed in the thread…

 
Posted : 28/11/2012 5:38 pm
(@redusadaz)
Posts: 7
Active Member
Topic starter
 

I've mounted with mount image pro, and then trying to use liveview to process

 
Posted : 28/11/2012 6:02 pm
(@ddelija)
Posts: 14
Active Member
 

it really depends on which version of vmarwe workstation are you using and forensic Sw or image mountig software…

more or less it works well on windows XP, with encase and latest workstation

but can be tricky on win 7

There are some info on that on guidance support forum

 
Posted : 28/11/2012 6:38 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

I've mounted with mount image pro, and then trying to use liveview to process

And what was the result? Did you get an error message from LiveView? If so, what was it, exactly?

 
Posted : 28/11/2012 7:46 pm
(@eyez0n)
Posts: 29
Eminent Member
 

I normally use FTK Imager to mount the .e01 and then LiveView to create the Virtual Machine (both of which are FREE!). My understanding is that LiveView is no longer supported and does not properly create VM's of Windows 7 boxes (I have not confirmed this yet for myself, however, so take it for what it is worth).

One of my co-workers used VFC (http//www.virtualforensiccomputing.com/) at his last place of employment and said it does work well with Windows 7 images. We have submitted a purchase request for it but not yet received the software so I cannot confirm its funcitonality (although I explicitly trust the co-worker's judgement).

 
Posted : 28/11/2012 10:58 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

I would much more plainly use
http//www.osforensics.com/tools/mount-disk-images.html
convert the thingy to RAW and then make either a .pln or a .vmdk descriptor file for it.

Then I would see if a Windows repair would make it boot under VMware.

jaclaz

 
Posted : 30/11/2012 12:44 am
(@yuriksoft)
Posts: 1
New Member
 

You can try connect .e01 disk images to VMware Workstation without converting it.
You can use Disk Adapter For VMware Workstation for this.
This link to article how it works https://www.yuriksoft.com/connecting-forensics-images-to-virtual-vmchine.html
And video instruction https://youtu.be/eZn5FrNqk1g

 
Posted : 03/12/2018 9:18 am
 EntT
(@entt)
Posts: 5
Active Member
 

If you mount the E01 using FTK Imager, you don't have to convert to RAW and take up double the disk space.

Of course, it won't boot very well if you don't allow write access which still makes you have to do a copy to keep your original E01 intact.

I use VirtualBox to boot the mounted image. You will have to run this first to create a .vmdk file
vboxmanage internalcommands createrawvmdk -filename "x\filename.vmdk" -rawdisk \\.\PhysicalDrive10Change filename path to whatever and the physicaldrive number to the one FTK Imager created.

 
Posted : 03/12/2018 9:50 am
 Dimi
(@dimi)
Posts: 13
Active Member
 

Use the linux tool 'xmount' to convert de E01 to VDI of VMDK

 
Posted : 03/12/2018 10:55 am
Page 1 / 2
Share: