0

It seems that most of the posts I can find show me how to take a VMDK and convert it to an FTK Image for processing. I'd like to go the other way, and get a bootable VMWare image. I've found the Virtual Forensic Computing tool, but I'm just a hobbyist and cannot afford to buy it. I was hoping LiveView would have been my savior, but it doesn't like the FTK image format.

Is there a tool that will do this for me for free with a little work? For example, I know that if I could get it to just a raw "dd" style dump, then I could use qemu-img covert to make it a VMDK.

2

Your question is confusing because you refer to the "FTK Image" format which doesn't exist. Perhaps you are referring to AccessData's AD1 format, which is a logical image and doesn't include things like unallocated space?

FTK Imager is a free tool that can create and convert disk images between many formats including the common ones like Encase E01, RAW dd, SMART S01, and Advanced Forensic Format AFF. It sounds like your problem will be solved if you can convert your file to a RAW/dd image since you can use qemu at that point. FTK Imager should be able to convert the format you are calling "FTK Image" into a RAW/dd and it meets your requirements of being free. Use the following steps:

Install FTK Imager or use the portable version and launch the application. File -> Create Disk Image -> Select Source = Image File -> Select your original file -> Finish -> Add Image Destination -> Raw (dd) -> Next -> Next -> Select a destination folder and filename -> Image Fragment Size = 0 -> Finish.

  • Great info! I'll try this now, thanks! And thanks for the clarification on the format/terms! – omghai2u Jul 3 '13 at 18:32
  • +1 FTK Imager can write a raw (dd) image and you should be okay from there. – adric Jul 3 '13 at 18:55
  • @Michael My AD1 images are split into multiple files (extensions like .E01, .E02, etc). When I "Select Source", it will only allow me to select one at a time. Is there a way around this? Or do I need to do them individually then somehow make the various DD images into one? – omghai2u Jul 3 '13 at 19:34
  • @omghai2u Just select the first file in a split image and FTK Imager will always look for additional parts. – Michael Yasumoto Jul 3 '13 at 20:04
1

I haven't tried this but you might be able to mount the "E01" image with Encase imager (also free) and if it does the same as the FTK Imager mounting, you can mount as physical and logical (or just physical is all that is necessary). I am guessing a bit, since Guidance and Accessdata are competitors in the market, and FTK Imager has mounting capability, then EnCase Imager might as well. In any case, then launch FTK Imager, and do the DD image output of the "physical" mount of the E01.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.