As I’ve said before, there often are a number of ways to accomplish a task in X-Ways Forensics (XWF), and a colleague at XWF pointed out an easier way to rebuild RAIDs. When we just want to build and boot a VM from an E01 image, we must go through the process of mounting it as a physical disk. Not so when we have a RAID and want to get to that point with XWF. XWF can rebuild the RAID directly from the E01 (or any supported) image files. The process begins by simply opening your image files from within XWF and choosing the option to include All Types of Images. Watch:
Next, we can elect to rebuild the RAID directly from the image files.
So, we don’t need to mount images as disks to rebuild a RAID in XWF. Should we proceed as I mentioned in my last post and create a DD image from the physical RAID with XWF, we will be able to create a VM directly from that image.