How to boot a VM form a Forensic Image
4 likes4,730 views
This document provides instructions for booting a virtual machine from a forensic image using VirtualBox and FTK Imager. It involves mounting the forensic image using FTK Imager to access it as a physical drive, creating a virtual disk file pointing to the mounted image, and configuring a new virtual machine in VirtualBox to use the virtual disk file. The process allows examining the forensic image content in a virtual machine but may corrupt the original evidence. Issues like startup repair errors can be fixed by deleting the VirtualBox user folder and repeating the procedure.
How to boot a VM form a Forensic Image
- 1. How to boot a VM from a Forensic Image Krešimir Hausknecht, M.Sci.
- 2. PLEASE BE CAREFULL! This process will probably change your original evidence so please make sure that it is being done on a copy!! 2
- 3. VirtualBox & FTK Imager Install: 1. FTK Imager 2. VirtualBox • https://www.virtualbox.org/wiki/Downloads - VirtualBox 5.0.20 for Windows hosts x86/amd64 3
- 4. 1. FTK Imager 1. File → Image Mounting 2. Select E01 image you want to mount 4
- 5. 1. FTK Imager 3. Mount type: physical only 4. Mount method: block device/writeable 5. Write cache folder: C:tempVBox_cache • Choose a preferred destination cache folder 6. Mount – you will see which physical drive the image is mapped to • Note the Physical drive number, we’ll need that later… 5
- 6. 6
- 7. 2. Create a new folder For storing the virtual disk file later Eg. C:tempVbox_temp 7
- 8. 3. Command prompt Run as administrator!! cd c:Program FilesOracleVirtualBox vboxmanage internalcommands createrawvmdk -filename C:tempVbox_tempimage.vmdk -rawdisk .physicaldriveX Replace the path, file name and physical drive accordingly 8
- 9. 4. VirtualBox Run as administrator! Creating a new virtual machine: • Name: image • Type: Microsoft Windows • Version: <Select accordingly> • Memory size: 2GB RAM • Hard disk: use an existing virtual hard disk file → image.vmdk • File we created in the step before • START the machine • Cross you fingers! 9
- 10. 10
- 11. Issues When dismounted and mounted again – doesn’t work! • Windows Error Recovery (Launch startup repair or start windows normally) • Delete the following folder: • C:Usersuser.VirtualBox • Repeat the procedure It will not always work 11