SIFT Workstation 2....
 
Notifications
Clear all

SIFT Workstation 2.12 problem

9 Posts
4 Users
0 Likes
932 Views
exus69
(@exus69)
Posts: 5
Active Member
Topic starter
 

Hello All,

Am running SIFT in VmWare. Surprisingly, I cannot copy paste
any documents from my Win 7 OS to SIFT Workstation
and vice versa. I checked the option of copy/paste & drag/drop
in VM Settings. Both are enabled. I've logged in as "root"
in SIFT.

Please help

 
Posted : 11/03/2012 7:35 am
BitHead
(@bithead)
Posts: 1206
Noble Member
 

Do you not believe the answers the person on TOS is giving you?

 
Posted : 11/03/2012 7:40 am
exus69
(@exus69)
Posts: 5
Active Member
Topic starter
 

Its not a question of not agreeing to him. Its about getting various solutions
from different sources and implementing the easiest ) I know which forum
you are referring to but what's TOS?

 
Posted : 11/03/2012 11:11 am
BitHead
(@bithead)
Posts: 1206
Noble Member
 

That Other Site - used when a poster does not want to specifically name a competing site.

From the answers there it sounds like a vmware issue not a sift issue. It just seems wrong to continue to call your problem a sift issue. I guess if you're looking for easy, posting a followup on a vmware forum would get you an easier solution.

 
Posted : 11/03/2012 6:23 pm
exus69
(@exus69)
Posts: 5
Active Member
Topic starter
 

But I still think its a SIFT problem because I tried to copy paste
from Win 7 to Backtrack 5 on VmWare and there were no problems!!

On TOS, I was suggested to use NFS shares but I figured out a way (I think
this is easier than NFS, I maybe wrong though) to setup a local ftp server on
Win 7 and then use the browser in SIFT to download the memory dump of my
Win 7 system. The problem was, as soon as the download began SIFT froze.
This happened a number of times. Disk space is not an issue here.

So now my problem has changed from copy paste to SIFT freezing while
downloading 3 GB of memory dump.

Please help

 
Posted : 11/03/2012 9:01 pm
twjolson
(@twjolson)
Posts: 416
Reputable Member
 

Are you trying to copy from Windows directly into SIFT? Or are you trying to copy to/from a shared folder?

The first would make me suspect VM Tools isn't installed or not running correctly.

The second would make me suspect a permissions issue.

At least, when I've had this problem, that's what the issue ended up being for me.

 
Posted : 12/03/2012 1:19 am
exus69
(@exus69)
Posts: 5
Active Member
Topic starter
 

Are you trying to copy from Windows directly into SIFT? Or are you trying to copy to/from a shared folder?

Yes am trying to copy from Windows directly into SIFT. Am also trying to drag and drop directly.
Both are not working. I don't know how to share folders between Linux and Windows. Hence
I setup ftp server on my Win 7, the best advantage being that this solution is platform
independent )

The first would make me suspect VM Tools isn't installed or not running correctly.

VM tools aren't installed at all. You are right but I can copy paste directly from Win 7 to Backtrack 5
without VM tools.

The second would make me suspect a permissions issue.

Its not a permission issue. Its actually disk space issue!! That's really strange because
my VM folder is 10GB (now increased to 15GB) and am still facing space issues!
Initially I was downloading the file with the help of the default Firefox browser and thats
where the hang problem was coming up but then it struck me to access the ftp server
from the file system address bar which helped to solve the hang issue. But it did not finish
and the following message popped up "There is 390.6 MB available, but 3.0 GB is required"

So how come am facing disk space problem when I've now allotted 15 GB to SIFT ?

Please help

 
Posted : 12/03/2012 4:17 pm
Buster
(@buster)
Posts: 28
Eminent Member
 

The first thing you need to do is make sure that shared folders are enabled in VMware. In the main VMware window, with the SIFT tab active go to "VM - Settings". In the dialogue box that is presented select the "Options" tab then "Shared Folders". Make sure that the "Always Enabled" radio button is selected.

Then, in the bottom right of the same dialogue box you have the option to add shared folders from your host system. By default SIFT creates a shared folder called "Host-C" which provides access from the SIFT workstation VM to the hosts main partition (C). This is normally accessible via the "VMware-Shared-Drive" folder on the SIFT desktop. You can also access it via the "mount_points/hgfs" path which is again on the desktop. If you want to add others just select "Add" and then navigate to the path that you want shared.

I personally tend to create a shared folder for each of the storage devices that I have installed on the host. For example I have a 2 TiB drive that I use to store evidence files and another that I use to store my case files. I have set up shared folders for both so that I can directly access from within the SIFT VM. That way I have no issues with running out of space on the VM because all data is stored on the host and I can easily view data using tools from the host as well as the VM.

If you do a lot of work at the command line, the length of the shared folder paths can get a bit tedious. To get around this create a symlink from your home folder (i.e. /home/sansforensics) which allows you to shorten the paths to just "cases" and "evidence" rather than "/home/sansforensics/VMware-Shared-Drive/cases".

The long and the short of it is, leave your data on the host and just access it via SIFT. I think you will find the whole thing easier to manage if you set it up that way.

Hope that helps.

Stu

 
Posted : 13/03/2012 2:53 pm
exus69
(@exus69)
Posts: 5
Active Member
Topic starter
 

My problem is solved and its a very silly solution but firstly I would like
to thank Buster, twjolson and BitHead (in no particular order) for
giving their valuable inputs and time to help me. Thanks alot guys
really appreciate your efforts.

I figured out that I was using the .iso version of SIFT in VM!! I had decided
to use the .iso version so that I could burn it on a DVD and use it on VM
as well, dual purpose. But I started facing issues (which I've mentioned
above) with the .iso version. So I downloaded the VmWare version
and now everything's working smoothly )

Byeee, until next problem lol )

 
Posted : 15/03/2012 1:03 pm
Share:
Share to...