Hi,
I am attempting to convert an E01 image into a VMDK using LiveView. I have managed to get this far using Physical Disk Emulator (PDE) in encase along with the LiveView software. However, when I try to boot the Virtual Machine through VMWare Workstation, I get as far as the Windows Startup screen and then get a Blue screen, it then goes back to the VMWare startup screen and tries again. This process continues until I power down the VM.
The image was taken from a Windows 7 64Bit machine. The image consists of 2 partitions, a recovery partition and the boot partition.
Has anyone come across any similar issues ? I am looking at getting an evaluation of MD5s VFC2 to see if it was the conversion process that is causing the issues.
Thanks.
From the LiveView page
"Live View is a Java-based graphical forensics tool that creates a VMware virtual machine out of a raw (dd-style) disk image or physical disk. "
Have you tried converting the .e0x file to a raw/dd file, and then running LiveView?
Just mount it with FTK Imager and point it to the mounted disk
Keydet89 is correct in that Liveview will only read a DD image. I have tried numerous times to use an E01 file and use FTK to mount it but to no success, PDE has given the same results. Convert the E01 to a DD and try it agin using the dd. Livevew is a good tool but the success rate is very low, based on my attempts.
Send me you email address and I'll send you the guide for Liveview.
. . . or just read the quick guide here http//
Thanks Jhup that's what I was going to send ……
Of course you could always use xmount which is tailor made for the job…
https://
You do need to use it from Linux or a Mac though.
Paul
I am attempting to convert an E01 image into a VMDK using LiveView. I have managed to get this far using Physical Disk Emulator (PDE) in encase along with the LiveView software.
Is that PDE in version 6? If so I've had nothing but problem with that anyway. FTK Imager is far better way (and free) of mounting disk image
The image was taken from a Windows 7 64Bit machine. The image consists of 2 partitions, a recovery partition and the boot partition.
I've noticed Windows 7 does seem to fail a lot, however Liveview does create the machine in a very old version. Sometimes upgrading the virtual machine helps make it work. Off the top of my head its VM -> upgrade virtual machine or something similar.
What is the aim of booting the virtual machine? Is it something that could be achieved by attaching the exhibits disk to an existing virtual machine (such as shadow copy examination)?
Try to get a version VFC.
Last couple of years I tried to convert lots of images to vmdk and VFC is much better then liveview.
It is worth the money.
VFC is the way to go, never let me down once, so much more it can do, worth the money
Mitch