Booting a forensics image on a Virtual Machine

When performing a forensics investigation on an image of the system drive, it may be necessary to recreate and examine the live environment of the system by booting the image on a virtual machine. By running a live system, the investigator is able to perform a live forensics analysis of the image allowing for the potential discovery of additional forensic artifacts that may not have been previously uncovered from a static analysis. Finally, because the system is running in a protected virtual environment, there is no risk of compromising the evidence or the host system itself.

In order to boot a virtual machine from the forensic image, it must first be converted into a format comptible with the Virtual Machine software (eg. VMWare, VirtualBox, Hyper-V).

Converting a forensics image to Virtual Machine disk format (eg. VMDK, VHD, VDI)

There are several 3rd party tools that convert a raw disk image to the appropriate Virtual Machine disk format. If the disk image is not in raw format, it can be converted as such using the OSForensics Drive Imaging module. The following table summarizes the list of tools available for converting a raw image to a Virtual Machine disk file. As these are 3rd party tools, please contact the original developer for any usage or support issues.

Conversion Tool Platform VMWare VirtualBox Hyper-V
qemu-img Unix
Windows
VBoxManage Windows/Unix
raw2vmdk Java (OS independent)
Live View Windows

Converting a raw image to a a VMDK file for use with VMWare or VirtualBox

VMWare and VirtualBox both support attaching existing VMDK disks to a virtual machine instance. Use one of the following tools to convert the raw disk image to a VMDK disk. Please see the documentation for each tools for additional options and capabilities.

Using qemu-img

        qemu-img convert -f raw rawimage.img -O vmdk vmwaredisk.vmdk

Using VBoxManage

        VBoxManage convertfromraw rawimage.img vmwaredisk.vmdk --format VMDK

Using raw2vmdk

        java -jar raw2vmdk.jar c:\\source\\rawimage.img c:\\destination\\vmwaredisk.vmdk

Converting a raw image to a a VHD/VHDX file for use with Hyper-V

Hyper-V supports attaching existing VHD disks to a virtual machine instance. Use one of the following tools to convert the raw disk image to a VHD disk. Please see the documentation for each tools for additional options and capabilities.

Using qemu-img

        qemu-img convert -f raw rawimage.img -O vhdx -o subformat=dynamic hypervdisk.vhdx

Using VBoxManage

        VBoxManage convertfromraw rawimage.img hypervdisk.vhd --format VHD

Creating a new Virtual Machine instance from the converted Virtual Machine disk

Once the forensic image has been converted to a Virtual Machine disk compatible with the virtualization sofware, the next step is to create a new virtual machine and attach the converted virtual disk to the machine. The procedure depends on the Virtual Machine software (and version) being used but most if not all allow an existing disk to be attached to the instance. The following screenshots demonstrate how to attach an existing virtual disk to a Virtual Machine instance for several common virtualization software.

Creating a new VMWare Player instance using the converted VMDK disk.

VMWare Player does not allow an existing disk to be attached when first creating the instance but can be attached after the instance has been created. Click on 'Create a New Virtual Machine' and follow the steps in the wizard.

When prompted, select the 'I will install the operating system later' option and specify the Guest Operating System. When prompted to specify the disk capacity for a new virtual disk, enter an arbitary small disk size and select 'Store virtual disk as a single file'. The exact settings do not matter as this disk will be deleted later and replaced by our converted disk.

Once the Virtual Machine is created, select 'Edit virtual machine settings'. Delete the 'Hard Disk' device and click 'Add' to add our converted VMDK disk. When prompted, select 'Use an existing virtual disk' and browse to the location of the converted VMDK disk.

Once the settings are applied, the Virtual Machine should be ready to boot your forensic image.

Creating a new VirtualBox instance using the converted VMDK disk.

Startup VirtualBox and click on 'New' to create a virtual machine. Follow the steps in the wizard until you are prompted to add a hard drive. Select 'Use an existing virtual hard drive file' and browse to the location of the converted VMDK disk.

Once the virtual machine is created, it should be ready to boot your forensic image.

Creating a new Hyper-V instance using the converted VHD disk.

Startup Hyper-V Manager and select Action > New > Virtual Machine to create a virtual machine. Follow the steps in the wizard until you are prompted to add a hard drive. Select 'Use an existing virtual hard disk' and browse to the location of the converted VHD/VHDX disk.

Once the virtual machine is created, it should be ready to boot your forensic image.

Additional Resources

Tools for booting a physical disk on a Virtual Machine

Tools for converting virtual disks to another virtual disk format