Virtualbox running ...
 
Notifications
Clear all

Virtualbox running encase/DD file

2 Posts
2 Users
0 Likes
3,083 Views
(@nonsence)
Posts: 1
New Member
Topic starter
 

Hello

Here is my contribution to run Encase image on something else than VMware Virtual Box (Free)
www.virtualbox.org

Boot Encase image (was WinXP) into Virtualbox
Tested on Virtualbox v3.2.6 installed on a Windows 7 US

Virtual box don't allow like VMware to boot directly from a Encase virtual (raw) disk. You need to perform additional step. Virtualbox don't support DD raw format natively.

Convert E01 file to one UNIQUE dd file (VDI conversion don't support multiple DD volume) using FTK imager.
Store your DD file in your Virtualbox VDI repository.

Generate one VDI file from the DD file
C\Users\test\.VirtualBox>"C\Program Files\Oracle\VirtualBox\VBoxManage.exe" convertfromraw ImageFile.dd OutputFile.vdi

Create your VM machine. During the wizard, use Virtual Media Manager to add the VDI file to the Virtualbox Hard disk repository.

Suspect hardware was a Dell laptop (dual core) and I get a blue screen the first time I boot it inside virtualbox…!

You need to change some settings
Motherboard Enable IO APIC
Processor Enable PAE/NX
Acceleration Enable both Nested paging and VT-X/AMD-v
Storage Change Controller type to ICH6; keep Host I/O cache enable

DisplayGive adequate RAM video (I put 128M)
Enable 2D and 3D acceleration.

Disconnect Network and USB device.

Configure a Shared folder if you need to transfer some files.
You don't need to enable a network interface to use shared folder.

Create a shared folder on your host (from VM settings)
From your guest, attach the share drive using the Windows Explorer
\\vboxsvr\name_of_your_share

vboxsrv is the default server name Virtualbox use for share folders.

Hope this help !

FT

 
Posted : 28/07/2010 3:27 am
binarybod
(@binarybod)
Posts: 272
Reputable Member
 

You can save a lot of time (and disk space) by using xmount which will mount EnCase (AFF or raw) images and expose them as vdi (dd or vmdk) block devices directly. You can use it to create a cache file that effectively allows write support without compromising the source image.

You can get xmount from https://www.pinguin.lu/index.php

Paul

 
Posted : 04/08/2010 5:53 pm
Share: