What happens after we acquired a bitstream on a disc image file?
Typically we begin the analysis of the disk by mounting the file dd (raw), or ewf aff, but at some point may be useful to virtualize the image for many reasons, such as launching the various tools of Nirsoft , Sysinternals , work with proprietary software installed on the machine experience, watching the processes, etc.. etc..
Until recently, the systems to virtualize an image file were to:
1) Convert the file format VMDK or VDI (VirtualBox or VMWare to name the two most common virtualizer), thus occupying more space on the hard disk and plenty of time machine.
2) Use the helpful LiveView, which prevents the conversion and enables the virtualization starting directly from the raw image file formats (dd).
LiveView but has severe limitations:
1) only runs on Windows.
2) Use VMWare and the only free version of VMWare server, which was accepted by LiveView, remained the 1.0.qualcosa .... now fairly antiquated.
Some time ago the good Louis Piciocchi ( Caine-from-deb ) told me about XMOUNT , immediately went to check on a surface, installed by the Ubuntu repositories and tried to use it, but it worked fine. .. Then I talked
chatting with John Lehr, who soon after wrote a post on his blog yesterday and told me I had to talk it over xmount download directly from the manufacturer, as that taken by the repository Canonical (Ubuntu) was buggy .
So I proceeded in this way:
https: / / www.pinguin.lu / index.php (download the DEB package)
sure you have the necessary requirements:
For those who use Linux - Kernel 2.6.x - FUSE library
For those using Mac OSX - OSX 10.5 or above - MacFUSE
• Verify that your user (the one we will use to launch the Virtual Machine) is in the group "fuse" (the root there for sure). In any case, it goes like this: sudo usermod-a-G fuse username (where username is your Linux user) and then edit the file "/ etc / fuse.conf" and uncomment (remove the #) the line user_allow_other.
Now just create a directory: eg.
sudo mkdir / media / lab
then issue the command: sudo
xmount - in dd - out EV - cache cache.dat disk.dd / media / lab to create
disk.vdi the file in the folder / media / lab.
then run VirtualBox and create a new virtual machine, using as a disk and all the disk.vdi it works!
The strength of this system is that the file disk.vdi is only "symbolic", because it does not really care to occupy the space that says, I personally have a virtualized file of 200GB on a disc that only had 180GB free.
Clearly in the example I used a raw input and output on VirtualBox, but I could also use the EWF format input and output formats in VMWare and / or all other combinations between VMWare / VirtualBox and formats dd / ewf / aff.
Yesterday I thought to create a graphical interface for XMount, but John has preceded me, working while I slept (for he was under great morning!) And, jokes aside, he made a GUI with YAD , evolution Zenity of ... can be found here, complete with debs for 0.4.4 and xmount YAD 0.5.2-1:
http://scripts4cf.sf.net/
Good job!
by Nanni Bassetti
0 comments:
Post a Comment