I created a VMDK from a raw forensic (physical) image file. I am using Oracle VirtualBox to try and run the machine. However, when I start the machine I receive the following error message:
Your PC/Device needs to be repaired
A required device isn't connect or can't be accessed.
Error code: 0xc000000f
Has anyone encountered this before?
That is perfectly normal.
Everyone that attempted doing the same as you did came off with an unbootable machine (via this or that error code), the basic issue is that any and all Windows NT installs are "customized/adapted" to a given machine/set of hardware, and the Virtual Machine has its own (virtual) hardware that may (or may not, and this is usually the case) be similar enough to the original hardware to allow booting.
There are dedicated "P2V" (Physical to Virtual) programs to allow these kinds of "transplants/translations", or it can be done manually (but this is not at all easy nor straightforward).
In any case in order to boot you will going to make large changes to the physical disk image contents, particularly on the filesystem and Registry, so the validity of the experiment from a purely forensic point of view needs to be assessed accurately.
Search (on the forum and the internet) for "P2V".
jaclaz
Â
