Got a fix, how to, or an answer? Earn some money!

... Info Report ...
Views: 22672
100% Success Rate (1 votes)
Did this work for you?
Logger: jake
Date: January 18th, 2011
| Share
... ...
How to Create a Virtual Machine from a Raw Hard Drive Image

How Do I...

I created a raw hard drive image, how can I convert it to a virtual machine?

How to Create an Image of a Hard Drive for Forensic Purposes
How to Make a Virtual Machine out of a Physical Computer using Free Software
DIY Computer Forensic Investigation
Tags: VMWare, dd, Image, dc3dd, ghost, Virtual Box, Virtual Machine, Raw, VMDK

How To

Summary: This how-to is part of a tutorial about DIY Computer Forensic Investigation.

Imaging a hard drive is a great way to create a virtual machine.  If you do not already have an image you can make one following this tutorial, which uses forensic imaging software developed for the Department of Defense's Cyber Crime Center. Once you have your image you will need some software to convert it and create a virtual machine.  Here is your download list:

  1. VMWare Workstation - You will need to register to download this file, after you register you may not be taken to the download page, just login to and click this link again
  2. VMware Disk Mount Utility - Live View require this.
  3. Java Runtime Environment - Live View requires this.
  4. Live View - Download this file: LiveViewPublicInstallerv0.7b.exe - this program will enble VMWare to use the raw image.

Step 1 - Install the Software

The software should be installed in the order listed above, so that Live View's requirements are installed first.

As you install the programs simply accept their default installation settings.

Step 2 - Run Live View

Image 1

Start Live View (a link should have put on your desktop when it installed.)

After it opens click Browse under Select Your Image or Disk, then open your raw image file.  (Image 1) Then you can click Browse under Select Output Directory... to tell Live View where to save the files.

Click Start - VMWare should now load your virtual machine.  If this is the first time that you have run VMWare it may prompt you for your serial number.  Then click File, Open and find the file that Live View created. 

You will probably be prompted that your image file is not read only.  That is because Live View is made for computer forensics and is focused on maintaining the integrity of the evidence.  You can allow Live View to set your image as read only, since Live View will create a seperate file for the changes.

Step 3 - What to do Next

Follow this to a tutorial showing how to reset a Windows login password on a virtual machine:

How to Reset a Window's Password on a Virtual Machine (VMWare) 

Additional Resources

There are no resources.


Add a Comment
There are no comments.