±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 0
Overall: 27500
Visitors: 59

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Convert .e01 to run on VMware

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Convert .e01 to run on VMware

Post Posted: Wed Nov 28, 2012 6:37 am

All

I'm trying to convert my image to run on VMware, but don't appear to be having much luck, or there is an easier way. I am following these instructions:

www.computerforensicsw...pic&t=3049  

redusadaz
Newbie
 
 
  

Re: Convert .e01 to run on VMware

Post Posted: Wed Nov 28, 2012 6:38 am

Which method did you use? Several were discussed in the thread...  

keydet89
Senior Member
 
 
  

Re: Convert .e01 to run on VMware

Post Posted: Wed Nov 28, 2012 7:02 am

I've mounted with mount image pro, and then trying to use liveview to process  

redusadaz
Newbie
 
 
  

Re: Convert .e01 to run on VMware

Post Posted: Wed Nov 28, 2012 7:38 am

it really depends on which version of vmarwe workstation are you using and forensic Sw or image mountig software...

more or less it works well on windows XP, with encase and latest workstation

but can be tricky on win 7

There are some info on that on guidance support forum  

ddelija
Member
 
 
  

Re: Convert .e01 to run on VMware

Post Posted: Wed Nov 28, 2012 8:46 am

- redusadaz
I've mounted with mount image pro, and then trying to use liveview to process


And what was the result? Did you get an error message from LiveView? If so, what was it, exactly?  

keydet89
Senior Member
 
 
  

Re: Convert .e01 to run on VMware

Post Posted: Wed Nov 28, 2012 11:58 am

I normally use FTK Imager to mount the .e01 and then LiveView to create the Virtual Machine (both of which are FREE!). My understanding is that LiveView is no longer supported and does not properly create VM's of Windows 7 boxes (I have not confirmed this yet for myself, however, so take it for what it is worth).

One of my co-workers used VFC (http://www.virtualforensiccomputing.com/) at his last place of employment and said it does work well with Windows 7 images. We have submitted a purchase request for it but not yet received the software so I cannot confirm its funcitonality (although I explicitly trust the co-worker's judgement).  

eyez0n
Member
 
 
  

Re: Convert .e01 to run on VMware

Post Posted: Thu Nov 29, 2012 1:44 pm

I would much more plainly use:
www.osforensics.com/to...mages.html
convert the thingy to RAW and then make either a .pln or a .vmdk descriptor file for it.

Then I would see if a Windows repair would make it boot under VMware.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 1