The other day, my colleague, Huey Nguyen, just asked Weg whether he could create a VM from a physically write-blocked disk. That was a great question, particularly as drives get bigger and imaging takes longer. Conceptually, it seemed possible, so I gave it a whirl and will demonstrate the process. First, readers should recall my post about creating VMs from mounted images (E01s). The process basically is the same. However, please recall my latest post, in which I discussed drives that are >2TB.
I’ll go through some, but not all, of the stuff that we’ve done before because many folks don’t like going back and forth to reference information. We’ll begin with a drive that I attached to my Tableau UltraBlock.
As you can see, I used the eSATA bus, but that’s irrelevant. As long as Windows can see the disk, we’re in good shape.
Note that our write-blocked is Disk 5. Next, we’ll let VMware do the work of building our configuration files. Here’s a quick refresher:
Next, we’ll navigate to the VM’s folder and open the VMX file in a text editor. We’ll edit the VMX file with respect to the disk type parameter for our disk, SCSI Drive 0, as in the next video.
Natively, VMware will not allow us to snapshot a physical disk. Editing the parameters allows us to trick VMware into thinking that we don’t have a raw disk. Next, we have to refresh our VM to take a snapshot, so just close and reopen your VM in VMware, and take a snapshot.
The next step is to edit the registry. Don’t worry, in addition to snapshot protection, our original drive is behind a physical write blocker.
After you’re finished, be sure to unmap the volume in VMware. However, if you want to remove any logon passwords, be sure to do so before you unmap your volume. I described that process in an earlier post, which suggested the NTPWEDIT tool. To unmap the volume in VMware, you may have to close all Explorer windows, or simply tell VMware for force a disconnect if prompted. Note that we could have used a SAS disk in our VM, but I think that the SCSI option is a little less confusing when it comes to editing the registry. After the edits, you may want to take another snapshot.
Next, sit back and behold your powers!