A great Program for mounting raw images is VDK. You can find this at
http://chitchat.at.infoseek.co.jp/vmware/vdk.html
Not sure on the implications of the forensics side of things though so you'll
have to look into that.
Hope this helps
Matt Steer
IT Service Desk Advisor
( x1527
È 07875307365
* matt.steer@wdb.co.uk
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] On
Behalf Of lance james
Sent: 20 February 2007 00:38
To: Neil Broom; Steven Hay; jeff@jeffbryner.com; forensics@securityfocus.com
Subject: Re: vmware converter
a dd image can be run by vmware just rename it to a .iso
On 2/18/07, Neil Broom <nbroom@trcglobal.com> wrote:
ProDiscover will convert a DD image to a bootable VMWare Machine.
Neil Broom
President
Technical Resource Center, Inc.
795 Hammond Drive
Suite #1806
Atlanta GA 30328
800-839-2088 Toll Free
678-428-6304 Atlanta
678-264-4900 Fax
nbroom@trcglobal.com
www.trcglobal.com
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] On
Behalf Of Steven Hay
Sent: Tuesday, February 13, 2007 2:18 PM
To: jeff@jeffbryner.com; forensics@securityfocus.com
Subject: RE: vmware converter
We've tried that product in testing, but we ended up purchasing this
product (DDChanger):
http://www.helperapps.com/index.php?option=com_content&task=view&id=1&It
emid=34
We were trying to convert boot from SAN Intel blades to VMWare servers
running on an AMD Opteron VMWare ESX box. It was a lot less money (as
you can get an unlimited use site license) and so far we haven't found
anything we couldn't convert to a VMWare session because of DDChanger's
ability to strip/replace hardware drivers and allowing you to chose what
to strip or reset (something that was missing with the VMWare tool).
There was a time VMWare P2V was painful for us but now we don't even
think about it when we virtualize. And since this is a positive review
I should also say that we don't have any affiliation to the company that
makes this product past being a satisfied customer.
They are in Europe so support is often "next day" by E-mail but I should
also mention they were helpful to our questions during our testing; we
haven't needed support since purchasing.
As for forensics I can't speak to the legal ramifications of changing
the hardware drivers of a system before an analysis.
Hope this helps.
Steve
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On Behalf Of Jeff Bryner
Sent: February 9, 2007 11:01 AM
To: forensics@securityfocus.com
Subject: vmware converter
http://www.vmware.com/products/converter/
Has anyone used this for forensics? i.e. take a system image and boot it
as a vmware session?
I've tried this before without this converter and ran into loads of
hardware compatibility issues especially with laptops and custom disk
drivers. Sometimes windows could recover and exchange the custom driver
for the default vmware driver, sometimes it couldn't.
If you've used it, what are the gotchas?
Jeff.
Please note that Internet email is not always private, secure or reliable.
The sender accepts no liability for any damages caused by any virus
inadvertently transmitted with this email. Any opinion expressed in this
email is solely that of the author, unless clearly indicated otherwise.
This email, and any attachments, may contain confidential and/or proprietary
information that is intended only for use by the addressee. If you are not
the intended recipient, any use, dissemination, forwarding, printing, or
copying of this email is strictly prohibited. If you received this email in
error, please delete the email and advise the sender of the delivery error.
Please note that Internet email is not always private, secure or reliable.
The sender accepts no liability for any damages caused by any virus
inadvertently transmitted with this email. Any opinion expressed in this
email is solely that of the author, unless clearly indicated otherwise.
This email, and any attachments, may contain confidential and/or proprietary
information that is intended only for use by the addressee. If you are not
the intended recipient, any use, dissemination, forwarding, printing, or
copying of this email is strictly prohibited. If you received this email in
error, please delete the email and advise the sender of the delivery error.
--
Lance James
Secure Science Corporation
Gmail used for outside mobile and non-confidential information.
____________________________________________________
This message has been checked for Viruses and has been found
to be clean.
Marston's PLC Group Services IT Department
____________________________________________________
**********************************************************************************
Visit our Web site at www.marstons.co.uk !!
This email is confidential and may be legally privileged as are any files
transmitted with it. It is intended solely for the use by the person to
whom it is addressed. If you are not the intended recipient, be advised
that you have received this e-mail in error and that any disclosure,
copying, distribution or any action taken or omitted to be taken in
reliance on it is strictly prohibited and may be unlawful.
Any views or opinions presented are solely those of the author and do
not necessarily represent those of Marston's PLC.
If you have received this e-mail in error please notify
The Marston's IT Service Desk on 01902 329500.
**********************************************************************************
