VMware 10 and E01s – Plus the Pesky “physical disk is already use” & “error reading volume” messages

I. VMware 10

VMware 10 is the latest release, and it will affect how we mount E01s if we want to boot them in VMware.  In my first post about booting E01 images, I explained that we had to mount them as physical disks (logical, too, if wanted).  The process involved the following steps:

  1. Mount the E01 image in FTK Imager (or similar tool).
  2. Create a VMware machine by selecting the mounted physical disk.
  3. Edit the vmx file to change rawDisk to Disk.
  4. Take a snapshot.
  5. Map the disk in VMware as writable.
  6. Edit the registry and strip passwords.

Well, Step 5 isn’t possible at this point.  If you try to map the disk as writable, VMware will present the message in the following screenshot.

Mount as writable

If you open the disk as read-only, it will map fine, but we will not be able to do any editing.  All is not lost.  Simply be sure to use FTK Imager to mount your disk as writable, so that it will cache edits.  Moreover, as we want to effect edits on a logical volume, be sure to have FTK Imager mount both the physical disk and logical volume.  Heretofore, we needed to mount only the physical disk.  Then create your VM as usual, but omit mapping the disk in VMware.  Although FTK Imager will discard the edits that you made to the mounted image when you unmount it, those changes will persist in your VMware snapshot.

Of course, you must remount the image whenever you want to access it in VMware.  One thing to remember is that, if you remount your image in FTK Imager, be sure that your drive number remains the same as the original, or you must edit your vmdk file to match the new number, Drive 7 in the example below.  Your vmdk file will include a line like this, based on the screenshot that follows:

RW 488397168 FLAT “\\.\PhysicalDrive7″ 0

mount

Doing things this way was something that we always could have done.  It just wasn’t my practice, and I almost never use an E01 as my working image file.  Even with a split DD image, you may fine mounting preferable to creating a vmdk file with all of the extents.

VMware never officially supported mapping physical disks as writable, and evidently patched Version 10 to prevent us from doing so, until we figure out a hack.  If I come up with one that allows writable physical disks, I’ll post back.  According to the VMware tech with whom I spoke, the issue was that too many users were damaging real media, i.e., real disks.  Actually, VMware also discourages users from snapshotting physical disks, and we get around that by editing the vmx file.  However, there also is a command line tool named vmrun in your VMware\VMware Workstation folder, and you always could have used that to create a snapshot of a physical disk.  As we have a simple method already, I won’t demonstrate vmrun.

II. Error Messages

Okay, if we’ve used mounted images for any length of time, we’ve probably been frustrated by an error messages that appear when we try to map a mounted image or boot it in VMware .  This message can show up regardless of whether we try to mount read only or writable.

error1

error2

These errors presents when something “out there” has a hook into your mounted image.  I don’t know what it could be or whether it can be several things.  I’ve tried to replicate them, with only limited success.  They seem to present when I do a lot of mapping/unmapping and mounting/unmounting.  Sometimes, if I unmounted the image, closed VMware, mounted the image again, started VMware, and tried to run the VM, I received an error message that is similar to the first one shown above.

It appears that the easiest way to get around the errors and get back to work is, in the words of your favorite Help Desk tech, “reboot your computer.”  That means your physical, host machine.  If that doesn’t work, post a comment and I’ll dig deeper when time permits.  Thanks for your time.

11 comments

  1. Ettore says:

    I have to confirm that mounting and unmounting physical disk leads to that error. I’ve a lot of suspended VM I have to kill due that problem. In a first time I’ve ceated the vm using the old workstation format (8.0) and it had seemed to go well but after a lot of mounting…ok you have understood ;-)
    I suggest if you need to virtualize E01 convert it to DD….but I’m ready to test further solutions.

    • jimmyweg says:

      Sometimes, the mounting/unmounting images does lead to issues. In those cases, a reboot often solves the problem.

  2. Pam says:

    I am on a system as the administrator, and able to follow the instructions above. Once I attempt to start the VM I get a different error stating:

    Insufficient Permission to Access the File

    Cannot open or one of the snapshots it depends on.

    Module DiskEarly power on failed.

    Failed to start virtual machine.

    I should note I’m using VMWare 10 on a Vista machine, loading E01 files. I have tried a reboot, to no avail. My image file is located on a different physical disk than my OS, and is mounted with FTK Imager. My VM files are stored on my local disk.

    • jimmyweg says:

      Hi, Pam. First, did you adjust the vmx and take a snapshot? When you mount the image as a physical disk with FTKI, select the “writeable” option. Remember, too, that VMware 10 won’t let you map a physical disk as writeable.

      • Pam says:

        Thanks for your reply!
        -I mounted the Image file as Physical and Logical using FTK, mount method: writeable
        -Started VMWare 10 and did a custom setup, with Vista x64 bit as OS, install later, 2GB ram, no network connection, and LSI Logic for SCSI controller. I chose the appropriate physical disk and created the VM.
        -I then modified the .vmx file from “rawDisk” to “Disk”
        -Took a snapshot, shut it down.
        -Then I mounted the system registry hive of the mounted .EO1 file and changed the Controlset001\services\LSI_SCSI value from 4 to 0
        -Unloaded hive
        I then started up VMWare 10 again and tried to boot my system, and got that error. I didn’t attempt to map anything as you’d pointed out VMWare 10 had issues with this.
        This image isn’t essential to my case, it was just a ‘nice to have’ and a good trial for the future, but so far VMWare isn’t playing very nice with me.

        Thanks!

        • jimmyweg says:

          I don’t see why it won’t boot. What error are you getting this time? Is ControlSet001 the current set?

          • Pam says:

            It is. I have created a quick screenshot video if you’d like to see the process I go through. Is there any way to send it your way, or you could email me for the link details?

          • jimmyweg says:

            I sent an email. Maybe I misunderstood, but have you tried to run VMware explicitly as Admin? What is the OS of the image system?

  3. I did everything that you said in your article and I still get the error message:

    “The physical disk is already in use

    Cannot open the disk ‘E:\Virtual Disk\New Virtual Disk-000002.vmdk’ or one of the snapshot disks it depends on.

    Module DiskEarly power on failed.

    Failed to start the virtual machine.”

    I am using VMWare WS v10.01. I have also tried it with VFC and I get the same error message.

    Can you help me.

    Thanks
    Pedro

  4. […] 7. Jimmy Weg has put up a nice tutorial on what you need to know when mounting your forensic images as physical disk to get them to boot in Vmware 10 http://justaskweg.com/?p=1355. […]

Leave a Reply

Your email address will not be published. Required fields are marked *

Blue Captcha Image
Refresh

*