±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 3 Overall: 36445
New Yesterday: 2 Visitors: 229

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

LiveView

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2, 3  Next 
  

hunterw
Member
 

LiveView

Post Posted: Aug 30, 06 17:57

Has anyone ever used LiveView, validated it, etc . . . . ??

liveview.sourceforge.net/  
 
  

keydet89
Senior Member
 

Re: LiveView

Post Posted: Aug 30, 06 19:39

Don't know what you mean by "validated it", but...

windowsir.blogspot.com...eview.html  
 
  

Andy
Senior Member
 

Re: LiveView

Post Posted: Sep 09, 06 14:07

Live View does a brilliant job of converting DD image file data for VMWare, but does anyone have an easy method of converting a VMware (vmdk) image to a DD (or EnCase) image, or any methods for creating an image from a VMware guest?

Andy  
 
  

keydet89
Senior Member
 

Re: LiveView

Post Posted: Sep 09, 06 16:53

Yes, I do. Fire up the VMWare guest, pop in a CD containing the ProDiscoverIR Server agent, and acquire the image.  
 
  

Andy
Senior Member
 

Re: LiveView

Post Posted: Sep 10, 06 01:33

I've not really looked too deeply into ProDiscover so forgive my ignorance, but is the server a free utitliy? I'll go on the site and take a look at it.

Since posting last I've found a small program that mounts a vmware image in Windows (and gives you a drive letter), this then let me image the drive as a normal attached device.  
 
  

bshavers
Senior Member
 

Re: LiveView

Post Posted: Sep 12, 06 04:25

I haven't tried this yet (but I'll try it this week), but would it be possible to;
*Edit the machine settings by adding a physical drive (to hold your image)
*Boot your VM suspect machine with a forensic boot floppy/CD
*Create an image of the VM suspect machine to the added physical drive with whatever tool you have on your floppy/CD (encase, replica, safeback, etc..)


Brett  
 
  

dietro
Senior Member
 

Re: LiveView

Post Posted: Sep 12, 06 18:18

- Andy
but does anyone have an easy method of converting a VMware (vmdk) image to a DD (or EnCase) image, or any methods for creating an image from a VMware guest?


Point FTK Imager to the VMDK file and it will open it as if it were a disk image. You can then export an image of it.  
 

Page 1 of 3
Page 1, 2, 3  Next