localizing a mounted HD

You can do this quite easily using a tool available for free from MS. I covered this in chapter 3 of "Windows Forensic Analysis Toolkit 3/e", but it's also described here

http//windowsir.blogspot.com/2011/01/accessing-volume-shadow-copies.html

…and here

http//justaskweg.com/?p=710

Ok, I'll review the information you provided and follow-up.

Thanks
Keydet89

If you feel courageous you can also try (although you'll need linux for this)
http//code.google.com/p/libvshadow/

I recently did a large update and it starts looking promising, but still considered experimental.

BTW additional info
http//www.forensicswiki.org/wiki/Windows_Shadow_Volumes

Just for the record, you can most probably use Clonedisk (Freeware/GUI) to convert the RAW image to VHD
http//reboot.pro/8480/

or, more simply raw2vhd
http//reboot.pro/9715/
http//reboot.pro/9715/#entry83781

Though from what has been posted here
http//justaskweg.com/?p=710
it seems like the "original" didn't end on a sector boundary, which is "strange".

@keydet89
But what is the actual need to convert it to VHD (or to vmdk)?
I mean, the issue you had with IMDISK is probably connected with the nature of IMDISK, a more "low level" driver such as MS own VSS SDK
http//reboot.pro/index.php?showtopic=6492&hl=
http//www.microsoft.com/en-us/download/details.aspx?id=23490
and possibly
http//msdn.microsoft.com/en-us/library/windows/desktop/bb530728(v=vs.85).aspx
or Total Mounter
http//reboot.pro/15170/
http//www.kernsafe.com/product/totalmounter.aspx
should be able to "mount" directly the RAW image in such a way that is accessible…

jaclaz

@keydet89
But what is the actual need to convert it to VHD (or to vmdk)?

In order to mount the image as a volume, in a manner that would allow access to the available VSCs.

In order to mount the image as a volume, in a manner that would allow access to the available VSCs.

I know that, the whole point is that there are more suited drivers than IMDISK to mount the RAW image directly without needing to "convert it" to VHD.

If you prefer I understood the procedure as "Since I found no driver capable of properly mounting the image as local disk then I converted it to a VHD so that I have been able to use …."

jaclaz

…the whole point is that there are more suited drivers than IMDISK to mount the RAW image directly without needing to "convert it" to VHD.

I'm not sure I follow. As you say, you can install a driver, or you can make a minor modification to the image file and use what's already installed (ie, Disk Management).

Is there a chance that you can share what the "more suited drivers" are?

Thanks.

In Previewing the responses thus far still does not answer my question (at least I don't believe so). Recap I have an eo1 image and using FTK imger mounted the file giving me a listed drive of M I now open a cmd window opening it in admin mode. Cd to M then type "vssadmin list shadows /for=m" I receive an error "cannot list m shadow list because m is not a local drive".
Imaging is not the problem as I know if I can get to the shadow files as stated above I can image it and load into FTK or encase. The issue is getting the system to recognize the FTK mounted e01 file as a local drive????