I've tried LiveView with no luck and Virtual Forensic Computing won't work on my PC (WIn 7).
Any other options ? Why in the hell won't VMW accept raw images ?
If you have $300 laying around you can use Mount Image Pro.
Before purchasing Mount Image Pro, you can download it and see if it works during the trial period. If it works, buy it, if not, don't. Paraben has a free disk mount utility, P2 eXplorer v2.0, that may work also.
If the issue is getting the imaged mounted, you could also try exporting the image to a drive and try to boot it as a physical drive in vmware. Or maybe convert your raw image to an E0 image, mount and boot that one. I've had a dd image and the E0 version of it, in which dd would not boot but the mounted E0 would…
And some images and drives, no matter what you do to them, no matter how they were imaged, no matter what system you are trying to boot them on virtually, just won't boot. I call those images "devil images', at least that's about the most technical word I can come up with to describe the frustration of trying to get them to boot.
I call those images "devil images', at least that's about the most technical word I can come up with to describe the frustration of trying to get them to boot.
D Thank you Brett for clarifying the technical terminology. That should be in the Forensic Wiki
You still have access to the original? Can you DD it?
Are you getting any specific errors?
I do not have access to the drive anymore. And when I execute VFC and select "vmware-mount.exe" it says "Could not validate on start - exiting". Is this because of the donge ? I'm trying the trial.
I believe 000001.vmdk only contains the modifications since the first snapshot.
Has the OP tried using Virtual box? I've use similar techniques in linux using the -loop switch while mounting the image. Then using vbox to make a vdmx.
Similarly this can be done in windows.
http//
I've tried LiveView with no luck and Virtual Forensic Computing won't work on my PC (WIn 7).
Any other options ? Why in the hell won't VMW accept raw images ?
Based on the subject line, I have to ask…is this a split image? In addition to the .001 file, is there also a .002 associated with the image, and then on to whatever is the final image file?
If this is the case, try cat'ing them all into a single image file; on Windows, the "type" command works very well for this. Then from there, you can try LiveView, or something like IMDisk - it's free, and you don't have to know the password in order to access the files.
HTH,
…is this a split image? In addition to the .001 file, is there also a .002 associated with the image, and then on to whatever is the final image file?
If this is the case, try cat'ing them all into a single image file; on Windows, the "type" command works very well for this. Then from there, you can try LiveView, or something like IMDisk - it's free, and you don't have to know the password in order to access the files.
HTH,
You can also use FTK Imager to convert (export) E0x files to a single dd image and mount it as described above.
HTH2.