Creating a VMware Virtual Machine from a Raw Image File

Welcome to my blog and first post!  My aim is to provide tutorials that describe some of the things about which my colleagues have questions.  I’m neither a seasoned blogger nor videographer, so please bear with me as I progress.  I don’t plan to produce a regularly updated journal on digital forensics, as many of the good folks in my blog list now publish.  Instead, I’ll try to provide some guidance on practices that may help others who haven’t had a chance to explore an area of computer forensics that I may have delved into repeatedly.  As you’ll see, I have a plan for a few topics and will consider suggestions thereafter.  I do, however, have a full time job that already extends beyond a  “reasonable” workday, so pardon my delays in posting.  The videos herein should be viewed in high-def, and you’re welcome to download them.

This will be a multi-part presentation that goes into creating VMware virtual machines and using them to examine shadow volumes.  First, we’ll create a virtual machine from a single dd image file.  In the next presentation, well examine the target system’s shadow volumes using VMware and X-Ways Forensics (XWF) http://www.x-ways.net/forensics/index-m.htmlWe can create a target-system VM from a segmented image, but it takes more work to create our configuration file.  We also can build a VM from other image formats, like E01, as long as we can mount the image as a physical disk.  First, I always take care to see that my image file is read only.  Our image file is MyImage.001.  There are a variety of ways to approach an exam of shadow volumes, and this is mine at the moment.  I’m using VMware 8.x, but the steps are the same in 7.x.

I’m going to assume that readers have a modest grasp of VMware and Windows shadow volumes.  The next presentation features XWF more prominently, and I encourage readers to pick up a copy, as it’s benefits go far beyond the points that I’ll present.

Step One is to create a disk descriptor (vmdk) file, which is a text file that contains the disk geometry and image name.  Below is a screen shot of the contents of a Vista/Win7 vmdk file.  The yellow-highlighted fields are the ones that you will edit.  The first is the number of sectors on the physical disk.  Next is the name of your image file.  Then, skip the next (cylinders) field one and be sure that your heads=255 and sectors=63.  Then enter the number of cylinders by calculating <total sectors>/255/63.  It’s 19458 in our example, and always round up to the next whole number and do not use commas.  I usually place this file in the same folder as my image, where we’ll name this file MyImage.vmdk.

Here’s an editable copy of our vmdk file: MyImage.txt.  Save the file as a text file and then change the extension to vmdk for actual use.  It’s configured for VMware 8.x.  If you’re wondering where to get the number of sectors, an easy approach is to highlight the image in XWF and select the Technical Details Report from the Specialist menu:

 

Next, we’ll create a VM, so open VMware and elect to create a new virtual machine.  At this point, the following video will save some explaining:

This is what we do: Run VMware and create a new VM.  Select the Custom option in the first window.  Choose to install the OS later.  Next, choose the OS (32 vs. 64 is not critical).  Then, pick a name for the VM and a path for the VM files.  It’s best to place them in their own folder.  In the next couple of screens, choose one processor and a little more memory (2-4GB) than the default.  In the network box, select “do not use…”  You can add a network adapter later.  For the I/O adapters box, select LSI Logic (SCSI).  In the Select a Disk box, choose “Use an existing virtual disk.”  Next, navigate to your vmdk file (MyImage.vmdk).  Then click Finish, and you will have built a basic VM.   Now, take a Snapshot in VMware: VM\Snapshot\Take Snapshot.

In the next step, we’re going to edit the registry of our VM (we don’t do this in XP) and remove the password (keep EFS in mind).  We mount the VM as a logical disk in read-write mode (remember, we’re working with a snapshot and the image file is RO).  So, mount the system partition in VMware as writable.  Watch the video: 

As you saw, I loaded the VM’s System hive in my host’s registry.  I navigated to the current control set and then to HKLM\NEWSYSTEM\ControlSet001\Services\LSI_SCSI.  I edited the Start value (DWORD) so that it’s 0x00.  The 0 has the effect of starting the service at “boot” automatically by the system loader.  You can edit the other Control Sets, but it’s unnecessary.  Then I unload the System hive and shut down Regedit.

Next, we’ll deal with the user’s password.  I use a free tool named ntpwedit.exe, http://cdslow.webhost.ru/ntpwedit/.  (It’s in Russian, but you’ll figure it out.)  We’ll run ntpwedit and point it to the SAM hive in your mounted virtual disk and remove any password that you wish.  Note that you usually can boot a VM with Nordahl’s CD and do so, but it doesn’t always work.  Watch:

Now, the VM is ready to boot.  You may wish to fire it up to be sure that it runs, but create another snapshot first.  We want to but be careful about doing anything that could create a restore point, which could delete one or more existing restore points.  For example, installing VMware Tools will create a restore point.  Snapshots allow us to go back and recover a pristine system.  It’s a good idea to check the shadow volumes in your image and be sure that they all show up later with their proper dates when we examine them.  In our example, there are 19:

 

 

39 comments

  1. Hi,

    Thanks for your excellent work and for sharing it!
    Just a quick question as you might have come across.
    I’m trying to write the System registry key as you said so, but on VMWare Workstation 8, when I try to map the partition as writable, got a Windows message saying it can’t open that drive letter.
    I’ve tried in VMWare Workstation 10, and I can map to a drive letter, but then I can’t open folder Config under Windows\System32, as says that I don’t have permissions. I tried of course to edit the permissions, but always get an error that can’t write.

    Have you ever came across something like it?

    Thanks

    • jimmyweg says:

      If you can map the volume as writable with VMware, it seems to be a permissions issue, as you noted. Win 8 can be a little fussier than 7. Have you disabled UAC? First try the normal way through Control Panel. If that doesn’t work, try HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System and set EnableLUA to 0x00. Note that you will be unable to use Metro Apps (so what).

  2. saintbin says:

    Hi Jimmy, may i got your need to boot from single dd image?
    1. i create a dd image from a system drive(logical drive) using ftk imager
    2. i create vmdk and VM according your posts step
    3. i load the VM system hive in my host’s registry and operated with your given method and removed the password use ntpwedit
    4. then i power on the VM, but the VM suspended on a starting but black screen. what’s the problem?

    can you help me ?

    • jimmyweg says:

      I don’t know about a black screen, and what do you mean by “VM suspended”? If you’re not even getting to Windows, there may be a problem with your target’s boot loader. Make sure you give it enough time, as it can be slow sometimes. What is the OS?

  3. saintbin says:

    Hi jimmmy, thanks to you that post a great blog.

    but ia have a question, can you tell me, how to loaded the VM’s System hive in my host’s registry and then how to navigated to the current control set and then to HKLM\NEWSYSTEM\ControlSet001\Services\LSI_SCSI?

    waiting you reply!

    • jimmyweg says:

      It’s in my posts, but mount your virtual disk after taking a snapshot. Mount it as writable. Then open regedit, and select load hive from the File menu, when your focus is on HKLM on your own registry. Navigate to the mounted virtual disk’s SYSTEM hive, select it, and give it a name. You should find the LSI_SCSI key in your mounted hive.

  4. Randy says:

    Thank you for taking the time to put together such helpful information! I am using VMWare Workstation 8 on a Windows 7 x64 host, and I created a VM from an E01 image of a Windows 7 machine.

    I was unable to map the virtual drive, and the vmware.log exposed the problem: “failed to open \\.\PhysicalDrive11 the physical disk is already in use”

    To solve this problem, I closed VMWare Workstation 8 and started it again running it “As Administrator”. It was a permissions issue accessing the physical disk, and running as Administrator fixed it.

  5. Johan S says:

    I solved it, I was not system admin. Thanks for a GREAT tutorial!

  6. Johan S says:

    Hi! Im stuck again. After mapping the “harddrive” with VM Ware as explained it shows in windows explorer, but it does not show in disk management and it does not show through regedit, so I can not choose the sytem file in it. I guess that some of my computer settings are not right. I would be wery happy if you could help me out again. Thanks for great information!

  7. Johan S says:

    Jimmy, I seem to be stuck on the piece to edit the registry. Where is the video located? I dont see links to it on this page.

  8. Alan says:

    I have the same problem as Diego. My image is a raw, dd image that opens fine in WinHex Specialist. I made changes to the number of sectors and to the image file name in your template. I saved the file as a vmdk. I do not think I made a mistake.

    • jimmyweg says:

      Hi, Alan. The “The file specified is not a virtual disk” error typically indicates a problem with your vmdk or an issue with your image. If you want to send the vmdk to me, email it to jweg mt. gov. In WinHex, click on the physical image and send the Technical Details Report, too, if available. Make sure that your vmdk file is in the folder with your image. Check that no commas are in any numbers, e.g., sectors. Double check that you named the image correctly in your vmdk. Check your math for number of cylinders.

      • Alan says:

        Thanks for the offer to troubleshoot it. I’ll send it to you. I double checked all that you suggested so I am hoping you can shed some light. BTW, I hate captchas.

        • jimmyweg says:

          Sent you an email. I also hate Captchas, but you can’t believe how many spam comments I was getting. I wish that there was an alternative, and I do use other blockers.

  9. Hans Marius says:

    Hi,

    Iam trying to bring up a machine from E01 file.

    You are using MyImage.001 in the vmdk file, but what should I type there when trying from an E01 file?

  10. Howdy! I just wish to give you a huge thumbs
    up for the great information you have got here on this
    post. I am returning to your blog for more soon.

  11. Brian says:

    Jimmy, what is required to get an XP image to boot up in the same manner? Thank you for your time.

  12. Diego says:

    I followed all steps with VMWare 8.x, but when I navigate to the vmdk file and click next I get the error: “The file specified is not a virtual disk”. I tried creating another VM and check the contents of the generated vmdk file, it contains some weird characters at the beginning and the end, but the file I made manually doesn´t. What could be the problem?

    • jimmyweg says:

      That usually means that your vmdk file contains an error or the wrong type of virual disk. Are you trying to create a vm from a dd image If you’re trying to create a VM from an E01 or mounted disk, you want to open the vmx file after you follow the steps in mypost on E01s.

  13. Brian says:

    Jimmy, I seem to be stuck on the piece to edit the registry. Where is the video located? I dont see links to it on thi spage.

  14. Phill says:

    How did you figure out that you have to modify the registry?
    And do you know why setting the registry key to 0 seems to get it to work?

    • jimmyweg says:

      First, Vista/7/8 VMs prefer SCSI disks. If you simply create one from scratch, SCSI is the default. As many have found, leaving an IDE drive in place usually results in a BSOD. IIRC, it’s a Stop 0x0000007B error, which should be a driver issue. It took a bit of testing and trial and error. The issue/conflicts doesn’t arise with a SCSI disk/drivers. But, the target system probably doesn’t use a SCSI disk, so it won’t load the driver at boot. Vista/7/8 include the LSI SCSI drivers, but we have to make them load at boot. All that takes is editing the driver’s Start value data to 0x00. Thereafter, the SCSI drivers will load at boot and the system will recognize your SCSI disk. Per MS, these are the available value data for Start values (summarized):

      0x0 Part of the (Boot) driver stack for the boot (startup), loaded by the Boot Loader.
      0x1 Represents a driver to be loaded (System) subsystem at Kernel initialization.
      0x2 To be loaded or started (Auto load) Control automatically for all startups,
      0x3 Load on Control but will not be started until demand, for example, by using the Devices icon in Control Panel.
      0x4 NOT TO BE STARTED UNDER ANY CONDITIONS.

  15. Good stuff Jimmy!

    I didn’t like having to modify the registry though so I used:

    ddb.adapterType = “ide”

    in the vmdk file to avoid it.

    Thanks!

    • jimmyweg says:

      Thanks, Stephane, I’m glad you found my post useful. Typically, Win7/Vista in VMware like SCSI drives, and XP uses IDE. However, if your VM boots, it doesn’t matter. If you have to strip a password and you use my approach for that, you have to mount the disk and edit the registry anyway. Even if you boot with a password-stripper disc, it edits the SAM, too.

  16. Jason says:

    Great Job here! Thanks so much for the step by step guide. Very informative.

    Few questions.

    Following the guide from ‘Creating a VM from 01 Images’ I was able to get a Win 7 64bit image to boot, but only once. After I shut it down and restarted it I keep getting the BSOD. I tried deleting everything and starting over but still had the BSOD. Anything changing outside of the files created in target directory, like in the VMWare Workstation folder/files? Any other thoughts on this?

    Also in this post in the section about editing the registry of the mapped image it says ‘In the next step, we’re going to edit the registry of our VM (we don’t do this in XP)’ What do you mean ‘we don’t do this in XP’. Do I not edit the registry in host system if its XP or do I not edit the registry of a XP image?

    Thanks again!

    • jimmyweg says:

      >After I shut it down and restarted it I keep getting the BSOD.

      If it boots once, it should boot indefinitely, absent something that went wrong in the VM guest. If it BSODs again, don’t do anything until you mount the virtual disk and recheck the registry to be sure that the LSI SCSI Start=0x00. If it reverted back to its original state, perhaps try taking another snapshot after you re-edit the registry. Maybe you somehow set the disk to non-persistent, although I don’t think that you can do that.

      >Do I not edit the registry in host system if its XP or do I not edit the registry of a XP image?

      Correct, you don’t. XPs usually don’t come with the native LSI drivers, anyway. You build an XP VM with the standard IDE disk. Then, to get it to boot, you’ll have to do a Windows repair in mnost cases. I can do a post on that if you think it would help a number of folks.

  17. jbscarva says:

    Excellent. Thanks very much!!!!

  18. Nadine Haven says:

    Thanks for the amazing info. I find these posts have a lot of material. I can’t wait to get a chance to impliment all these great posts. Thank you very much.

  19. Outstanding work. Ditto Mr.O’Sullivan’s Comments. Bookmarking and sharing (if you don’t mind).

  20. William O'Sullivan says:

    Excellent article and explanation. Thank you!

Leave a Reply

Your email address will not be published. Required fields are marked *