VMware

Discussion in 'OT Technology' started by UncleJohn, Sep 28, 2004.

  1. UncleJohn

    UncleJohn "That guy"

    Joined:
    Aug 10, 2004
    Messages:
    9,346
    Likes Received:
    0
    Location:
    New York
    Anyone know how to use VMware to boot image files made by forensic tools such as Encase? It would have a .E01 extension....
     
  2. EvilSS

    EvilSS New Member

    Joined:
    Jun 11, 2003
    Messages:
    5,104
    Likes Received:
    0
    Location:
    STL
    Can you apply the image to fresh HD? If so you could create one VM with two drives and Windows, image the Encase ..er.. image to the second drive, then close that VM, copy the drive you imaged to, create a new VM with that as the primary drive (confused yet?)

    Or, if Encase will boot a floppy or CD to lay down the image, you can boot the VM to floppy and go from there.
     
  3. Aimless

    Aimless Resident drunkey

    Joined:
    Nov 5, 2001
    Messages:
    2,534
    Likes Received:
    0
    Location:
    Wisconsin
    However you would do it with a "real" PC
     
  4. Penguin Man

    Penguin Man Protect Your Digital Liberties

    Joined:
    Apr 27, 2002
    Messages:
    21,696
    Likes Received:
    0
    Location:
    Edmonton, AB
    :werd:
     
  5. UncleJohn

    UncleJohn "That guy"

    Joined:
    Aug 10, 2004
    Messages:
    9,346
    Likes Received:
    0
    Location:
    New York
    Encase is a software program that makes a image of a harddrive without editing it at all... Its not your standard file set... It makes a series of files each about 656mb until the entire harddrive including free space and file slack is copied... Any suggestions now?
     
  6. EvilSS

    EvilSS New Member

    Joined:
    Jun 11, 2003
    Messages:
    5,104
    Likes Received:
    0
    Location:
    STL
    Yea, I get that. Same as about every other drive imaging program (I know it isn't the same exact thing, but the general principle is the same). I guess my (and every one else's) point is you would pretty much do it they way you normally would with a regular PC. I mean, what do you DO with the image files once you get them off the first computer? Because whatever it is, that's what you would do with the VM also.
     

Share This Page