Boot dd images in V...
 
Notifications
Clear all

Boot dd images in VMware

8 Posts
7 Users
1 Likes
4,162 Views
Northwind
(@northwind)
Posts: 33
Eminent Member
Topic starter
 

Boot dd images on VMware, which program can I do?

 
Posted : 16/07/2020 3:22 pm
(@rich2005)
Posts: 535
Honorable Member
 

https://vfc.uk.com/ is the easiest way (commercial software).

When not using VFC I seem to remember I managed to have some success with using VirtualBox after converting the images to VDI with VBoxManage

 
Posted : 16/07/2020 3:35 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 
Posted by: @northwind

Boot dd images on VMware, which program can I do?

Depending on the version of vmware you can create a .pln or a .vmdk descriptor, manually or through a (simple) script, or some free programs, see:
https://www.forensicfocus.com/forums/general/create-a-vm-from-dd-files/
https://www.forensicfocus.com/forums/general/password-search/#post-6547159
https://www.forensicfocus.com/forums/general/boot-a-dd-into-a-virtual-machine-with-virtualbox/

Of course the above is about "accessing" or "mounting" a dd image in VmWare, actually booting it may be an entirely different problem, and - at least for Windows NT based systems - there are a number of issues, you will probably need to to use some P2V (Physical to Virtual) conversion software (the changes can be made also manually of course but it would take hours to learn what is needed to do and actually doing it manually).

There are free tools for P2V a well, but of course since there will be (quite a few) changes to the contents of the image in a foirensics context they must be taken into account and documented, see:

https://www.forensicfocus.com/forums/forensic-software/qemu-img-to-convert-from-e01-to-vmdk/

jaclaz

 
Posted : 16/07/2020 6:06 pm
watcher
(@watcher)
Posts: 125
Estimable Member
 
Posted by: @northwind

Boot dd images on VMware, which program can I do?

In the past I've done this by:

Adding an empty virtual drive to an existing Linux VM as a secondary unmounted drive.

Power up the Linux VM and dd the dd image from a shared folder to the unmounted empty VM drive.

Power down the Linux VM.

Re-assign the newly populated VMDK to a new VM as the boot drive.

 
Posted : 16/07/2020 10:12 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 
Posted by: @watcher

In the past I've done this by:

Adding an empty virtual drive to an existing Linux VM as a secondary unmounted drive.

Power up the Linux VM and dd the dd image from a shared folder to the unmounted empty VM drive.

Power down the Linux VM.

Re-assign the newly populated VMDK to a new VM as the boot drive.

With all due respect, in case of a large image that means hours instead of seconds for the "conversion".

jaclaz

 
Posted : 17/07/2020 7:32 am
Passmark
(@passmark)
Posts: 376
Reputable Member
 

OSForensics also does it.

Would have loved to post a screen shot. But forum doesn't support images 😥 

You can find a screen shot here however

 
Posted : 30/07/2020 12:50 am
 RoBB
(@robb)
Posts: 1
New Member
 
Posted by: @watcher
Posted by: @northwind

Boot dd images on VMware, which program can I do?

In the past I've done this by:

Adding an empty virtual drive to an existing Linux VM as a secondary unmounted drive.

Power up the Linux VM and dd the dd image from a shared folder to the unmounted empty VM drive.

Power down the Linux VM.

Re-assign the newly populated VMDK to a new VM as the boot drive.

I've had good results doing similar, when other auto products have failed.
It does take some time copying, but overall it's worthwhile.

 

 
Posted : 30/07/2020 7:56 am
(@tic-tac)
Posts: 24
Eminent Member
 

You could install VirtualBox and that would also install VBoxManage which can be used to convert images between different formats.

To convert from RAW to VMDK you would open the cmd, change to the directory where you have your raw image and type the following command:

"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" convertdd image.dd image.vmdk --format VMDK

Once it's done, open VMWare, create the virtual machine and when prompted to create a new drive just choose to "use an existing drive" or something like that.
 
Posted : 06/12/2020 9:48 am
dimension reacted
Share: