Forensics
RE: vmware converter Feb 13 2007 07:17PM
Steven Hay (shay communitysavings ca) (1 replies)
We've tried that product in testing, but we ended up purchasing this
product (DDChanger):

http://www.helperapps.com/index.php?option=com_content&task=view&id=1&It

emid=34

We were trying to convert boot from SAN Intel blades to VMWare servers
running on an AMD Opteron VMWare ESX box. It was a lot less money (as
you can get an unlimited use site license) and so far we haven't found
anything we couldn't convert to a VMWare session because of DDChanger's
ability to strip/replace hardware drivers and allowing you to chose what
to strip or reset (something that was missing with the VMWare tool).

There was a time VMWare P2V was painful for us but now we don't even
think about it when we virtualize. And since this is a positive review
I should also say that we don't have any affiliation to the company that
makes this product past being a satisfied customer.

They are in Europe so support is often "next day" by E-mail but I should
also mention they were helpful to our questions during our testing; we
haven't needed support since purchasing.

As for forensics I can't speak to the legal ramifications of changing
the hardware drivers of a system before an analysis.

Hope this helps.

Steve

-----Original Message-----
From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]]
On Behalf Of Jeff Bryner
Sent: February 9, 2007 11:01 AM
To: forensics (at) securityfocus (dot) com [email concealed]
Subject: vmware converter

http://www.vmware.com/products/converter/

Has anyone used this for forensics? i.e. take a system image and boot it
as a vmware session?

I've tried this before without this converter and ran into loads of
hardware compatibility issues especially with laptops and custom disk
drivers. Sometimes windows could recover and exchange the custom driver
for the default vmware driver, sometimes it couldn't.

If you've used it, what are the gotchas?

Jeff.

Please note that Internet email is not always private, secure or reliable. The sender accepts no liability for any damages caused by any virus inadvertently transmitted with this email. Any opinion expressed in this email is solely that of the author, unless clearly indicated otherwise. This email, and any attachments, may contain confidential and/or proprietary information that is intended only for use by the addressee. If you are not the intended recipient, any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. If you received this email in error, please delete the email and advise the sender of the delivery error.

Please note that Internet email is not always private, secure or reliable. The sender accepts no liability for any damages caused by any virus inadvertently transmitted with this email. Any opinion expressed in this email is solely that of the author, unless clearly indicated otherwise. This email, and any attachments, may contain confidential and/or proprietary information that is intended only for use by the addressee. If you are not the intended recipient, any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. If you received this email in error, please delete the email and advise the sender of the delivery error.

[ reply ]
RE: vmware converter Feb 19 2007 03:29AM
Neil Broom (nbroom trcglobal com) (1 replies)
Re: vmware converter Feb 20 2007 12:38AM
lance james (lancej gmail com)


 

Privacy Statement
Copyright 2010, SecurityFocus