Convert .e01 to run on VMware

Which method did you use? Several were discussed in the thread…

I've mounted with mount image pro, and then trying to use liveview to process

it really depends on which version of vmarwe workstation are you using and forensic Sw or image mountig software…

more or less it works well on windows XP, with encase and latest workstation

but can be tricky on win 7

There are some info on that on guidance support forum

I've mounted with mount image pro, and then trying to use liveview to process

And what was the result? Did you get an error message from LiveView? If so, what was it, exactly?

I normally use FTK Imager to mount the .e01 and then LiveView to create the Virtual Machine (both of which are FREE!). My understanding is that LiveView is no longer supported and does not properly create VM's of Windows 7 boxes (I have not confirmed this yet for myself, however, so take it for what it is worth).

One of my co-workers used VFC (http//www.virtualforensiccomputing.com/) at his last place of employment and said it does work well with Windows 7 images. We have submitted a purchase request for it but not yet received the software so I cannot confirm its funcitonality (although I explicitly trust the co-worker's judgement).

I would much more plainly use
http//www.osforensics.com/tools/mount-disk-images.html
convert the thingy to RAW and then make either a .pln or a .vmdk descriptor file for it.

Then I would see if a Windows repair would make it boot under VMware.

jaclaz

You can try connect .e01 disk images to VMware Workstation without converting it.
You can use Disk Adapter For VMware Workstation for this.
This link to article how it works https://www.yuriksoft.com/connecting-forensics-images-to-virtual-vmchine.html
And video instruction https://youtu.be/eZn5FrNqk1g

If you mount the E01 using FTK Imager, you don't have to convert to RAW and take up double the disk space.

Of course, it won't boot very well if you don't allow write access which still makes you have to do a copy to keep your original E01 intact.

I use VirtualBox to boot the mounted image. You will have to run this first to create a .vmdk file
vboxmanage internalcommands createrawvmdk -filename "x\filename.vmdk" -rawdisk \\.\PhysicalDrive10Change filename path to whatever and the physicaldrive number to the one FTK Imager created.

Use the linux tool 'xmount' to convert de E01 to VDI of VMDK