How to boot a virtual machine form a Digital Forensic Image such as E01 or RAW.

1. How to boot a VM from
a Forensic Image
Krešimir Hausknecht, M.Sci.

2. PLEASE BE CAREFULL!
This process will probably change your
original evidence so please make sure
that it is being done on a copy!!
2

3. VirtualBox & FTK Imager
Install:
1. FTK Imager
2. VirtualBox
• https://www.virtualbox.org/wiki/Downloads - VirtualBox 5.0.20 for
Windows hosts x86/amd64
3

4. 1. FTK Imager
1. File → Image Mounting
2. Select E01 image you want to mount
4

5. 1. FTK Imager
3. Mount type: physical only
4. Mount method: block device/writeable
5. Write cache folder: C:tempVBox_cache
• Choose a preferred destination cache folder
6. Mount – you will see which physical drive the image is
mapped to
• Note the Physical drive number, we’ll need that later…
5

6. 6

7. 2. Create a new folder
For storing the virtual disk file later
Eg. C:tempVbox_temp
7

8. 3. Command prompt
Run as administrator!!
cd c:Program FilesOracleVirtualBox
vboxmanage internalcommands createrawvmdk -filename
C:tempVbox_tempimage.vmdk -rawdisk .physicaldriveX
Replace the path, file name and physical drive accordingly
8

9. 4. VirtualBox
Run as administrator!
Creating a new virtual machine:
• Name: image
• Type: Microsoft Windows
• Version: <Select accordingly>
• Memory size: 2GB RAM
• Hard disk: use an existing virtual hard disk file → image.vmdk
• File we created in the step before
• START the machine
• Cross you fingers!
9

10. 10

11. Issues
When dismounted and mounted again – doesn’t work!
• Windows Error Recovery (Launch startup repair or start windows
normally)
• Delete the following folder:
• C:Usersuser.VirtualBox
• Repeat the procedure
It will not always work 
11

12. Questions
Kresimir.hausknecht@insig2.eu
https://hr.linkedin.com/in/kresimirhausknecht