Forensics
RE: vmware converter Feb 23 2007 01:08PM
Matt Steer (Matt Steer marstons co uk)
A great Program for mounting raw images is VDK. You can find this at

http://chitchat.at.infoseek.co.jp/vmware/vdk.html

Not sure on the implications of the forensics side of things though so you'll have to look into that.

Hope this helps

Matt Steer
IT Service Desk Advisor
( x1527
È 07875307365
* matt.steer (at) wdb.co (dot) uk [email concealed]


-----Original Message-----
From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]] On Behalf Of lance james
Sent: 20 February 2007 00:38
To: Neil Broom; Steven Hay; jeff (at) jeffbryner (dot) com [email concealed]; forensics (at) securityfocus (dot) com [email concealed]
Subject: Re: vmware converter

a dd image can be run by vmware just rename it to a .iso

On 2/18/07, Neil Broom <nbroom (at) trcglobal (dot) com [email concealed]> wrote:
> ProDiscover will convert a DD image to a bootable VMWare Machine.
>
> Neil Broom
> President
>
> Technical Resource Center, Inc.
> 795 Hammond Drive
> Suite #1806
> Atlanta GA 30328
>
> 800-839-2088 Toll Free
> 678-428-6304 Atlanta
> 678-264-4900 Fax
> nbroom (at) trcglobal (dot) com [email concealed]
> www.trcglobal.com
>
>
> -----Original Message-----
> From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]] On
> Behalf Of Steven Hay
> Sent: Tuesday, February 13, 2007 2:18 PM
> To: jeff (at) jeffbryner (dot) com [email concealed]; forensics (at) securityfocus (dot) com [email concealed]
> Subject: RE: vmware converter
>
> We've tried that product in testing, but we ended up purchasing this
> product (DDChanger):
>
> http://www.helperapps.com/index.php?option=com_content&task=view&id=1&It

> emid=34
>
> We were trying to convert boot from SAN Intel blades to VMWare servers
> running on an AMD Opteron VMWare ESX box. It was a lot less money (as
> you can get an unlimited use site license) and so far we haven't found
> anything we couldn't convert to a VMWare session because of DDChanger's
> ability to strip/replace hardware drivers and allowing you to chose what
> to strip or reset (something that was missing with the VMWare tool).
>
> There was a time VMWare P2V was painful for us but now we don't even
> think about it when we virtualize. And since this is a positive review
> I should also say that we don't have any affiliation to the company that
> makes this product past being a satisfied customer.
>
> They are in Europe so support is often "next day" by E-mail but I should
> also mention they were helpful to our questions during our testing; we
> haven't needed support since purchasing.
>
> As for forensics I can't speak to the legal ramifications of changing
> the hardware drivers of a system before an analysis.
>
> Hope this helps.
>
> Steve
>
>
> -----Original Message-----
> From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]]
> On Behalf Of Jeff Bryner
> Sent: February 9, 2007 11:01 AM
> To: forensics (at) securityfocus (dot) com [email concealed]
> Subject: vmware converter
>
> http://www.vmware.com/products/converter/
>
> Has anyone used this for forensics? i.e. take a system image and boot it
> as a vmware session?
>
> I've tried this before without this converter and ran into loads of
> hardware compatibility issues especially with laptops and custom disk
> drivers. Sometimes windows could recover and exchange the custom driver
> for the default vmware driver, sometimes it couldn't.
>
> If you've used it, what are the gotchas?
>
> Jeff.
>
>
>
> Please note that Internet email is not always private, secure or reliable.
> The sender accepts no liability for any damages caused by any virus
> inadvertently transmitted with this email. Any opinion expressed in this
> email is solely that of the author, unless clearly indicated otherwise.
> This email, and any attachments, may contain confidential and/or proprietary
> information that is intended only for use by the addressee. If you are not
> the intended recipient, any use, dissemination, forwarding, printing, or
> copying of this email is strictly prohibited. If you received this email in
> error, please delete the email and advise the sender of the delivery error.
>
> Please note that Internet email is not always private, secure or reliable.
> The sender accepts no liability for any damages caused by any virus
> inadvertently transmitted with this email. Any opinion expressed in this
> email is solely that of the author, unless clearly indicated otherwise.
> This email, and any attachments, may contain confidential and/or proprietary
> information that is intended only for use by the addressee. If you are not
> the intended recipient, any use, dissemination, forwarding, printing, or
> copying of this email is strictly prohibited. If you received this email in
> error, please delete the email and advise the sender of the delivery error.
>
>

--
Lance James
Secure Science Corporation
Gmail used for outside mobile and non-confidential information.

____________________________________________________

This message has been checked for Viruses and has been found
to be clean.

Marston's PLC Group Services IT Department
____________________________________________________

************************************************************************
**********
Visit our Web site at www.marstons.co.uk !!

This email is confidential and may be legally privileged as are any files
transmitted with it. It is intended solely for the use by the person to
whom it is addressed. If you are not the intended recipient, be advised
that you have received this e-mail in error and that any disclosure,
copying, distribution or any action taken or omitted to be taken in
reliance on it is strictly prohibited and may be unlawful.

Any views or opinions presented are solely those of the author and do
not necessarily represent those of Marston's PLC.

If you have received this e-mail in error please notify
The Marston's IT Service Desk on 01902 329500.
************************************************************************
**********

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus