Raw Image to VMDK… the Easy Way
In my last post I chronicled the time consuming process of converting an image produced using the Unix dd utility to a vmware VMDK virtual disk. The process does work, but VMWare will only load it if the image contains a master boot record that still contains the appropriate information when removed from the rest of the system. Additionally, I think it is appropriate to mention again how terribly slow it is. We can circumvent these problems with Live View for Windows, a program developed for forensic work by Carnegie Mellon University.
The process for creating the image with dd is the same as last time, IE, by doing something along the lines of:
dd if=/dev/hdc3 of=/mnt/external/diskImage/XPSP2.img bs=1024
Once that image is generated and you are back in Windows, simply launch the Live View utility and… the rest is pretty self explanatory. Once the dd image is generated, the Live View program takes only a couple minutes to create the new vmdk, configure the virtual machine, and launch it. Sweet, sweet efficiency!
Thank you for introducing me to Live View. There is a problem with the previous article that you referenced. You suggested the following command.
dd if=/dev/hdc3 of=/mnt/external/diskImage/XPSP2.img bs=1024
Depending on the situation (excluding drives with multiple boot partitions) Live View seems to like taking a DD of the whole drive.
dd if=/dev/hdc of=/mnt/external/diskImage/XPSP2.img bs=1024
Just posting my experience.
Sep 11th, 2008 at 2:05 pm
Very nice tutorial, but is there also a solution to do the same completely under linux? Live View is for window only and doesn’t run under wine.
Feb 23rd, 2009 at 4:44 am
Thank you for the intro using LiveView and the explanation on using dd from a Linux live CD.
I installed LiveView successfully on a windows XP. When i try to
take in an IMG file (93 GB) to create the corresponding vmdk onto an external hard drive, Live View complains and fails with the following error message (as quoted from its log file). The problem is with the vmrun.exe underlying command not reaching the virtual machine (it says it’s interrupted).
I am a newbe on these matters. Another issue is how do i run VMPlayer on another existing VM i have on the c drive (I ask because installing VMPlayer is not allowed when VMServer is already installed) ?
Thank you,
best regards,
-claude
LiveView log file:
…
…
Executing: [reg, query, "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders", /v, Common AppData]
Output: Detected VMWare Server Installation
Output: Detected full disk image
Output: Generating vmx file…
Output: Generating vmdk file…
External Proc Output: ! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Common AppData REG_SZ C:\Documents and Settings\All Users\Application Data
External Process Error:
Path TO VMServer vm-list: C:\Documents and Settings\All Users\Application Data\VMware\VMware Server\vm-list
String to add: config “H:\\XPSP2SQL2005OPT.img.vmx”
vmx was already in vm-list, skipping append
Executing: [C:\Program Files\VMware\VMware Server\..\VMware VIX\vmrun.exe, snapshot, H:\\XPSP2SQL2005OPT.img.vmx]
Output: VMX added to VMWare Server Config
External Proc Output: Error: The system returned an error. Communication with the virtual machine may have been interrupted.
Error: The system returned an error. Communication with the virtual machine may have been interrupted
External Process Error:
Error: Snapshot Creation Failed
Error: Problem preparing partition2 for launch
Output: VM Launch Failed
User Closed Program Window
Stopped running processes
Executing: [C:\Program Files\VMware\VMware Virtual Disk Development Kit\bin\vmware-mount.exe, k:, /f]
External Proc Output: The volume was not mounted by VMware-mount. It may be a network drive or
it may have been mounted using another utility. It cannot be dismounted.
External Process Error:
Executing: [reg, unload, HKLM\NEWSYSTEM]
External Proc Output:
Error: ep: Error: The parameter is incorrect.
Executing: [reg, unload, HKLM\NEWSOFTWARE]
External Proc Output:
Error: ep: Error: The parameter is incorrect.
Cleaned Up
Apr 5th, 2009 at 9:22 am
Hi again,
I think I may have found the answer to the problem I posted yesterday. It has to do with my attempt on installing this on a XP Pro SP 2 who’s IIS 5.1 (Internet Information Services) does not support the running of two or more websites at the same time: during LiveView’s installation, I received a warning message saying “VMware Management Interface Website was correctly configured but failed to start. The site will have to be started manually from the IIS”.
So: in IIS (i.e. run–>inetmgr) I stopped my default website from running and started the newly installed VMware Management Interface 1.0.8 (by the way, as a side question, why does not LiveView 0.7b support latest VMware 2.0 and forces me to install an oldr version 1.0.8 ?).
Now, Thanks to LiveView, I have the IMG running in a VM…wow impressive…
best regards,
claude
Apr 6th, 2009 at 7:31 am
@Claude:
Sorry I didn’t see your question originally, but thank you for taking the time to come back and post the solution! I appreciate your comments :)
Apr 15th, 2009 at 1:54 pm
Hey, guys. You can increase the performance of dd, significantly, if you enlarge the block size say by 10 fold (e.g. 10240).
Apr 20th, 2009 at 3:53 pm
@michael barto Very true. Thanks for the tip :)
Apr 27th, 2009 at 2:12 am
It appears that the LiveView download page on source forge is broken :-( when attempting to download I receive “Unable to find any mirror information for the “LiveViewPublicInstallerv0.7b.exe” file. Please select another file.” Does the OP have a copy they would be willing to make available?
Jul 22nd, 2009 at 1:01 pm
The way to use dd on windows, is to download it from
http://www.chrysocome.net/dd
and launch in cmd… It will be more comfortable to extract acrhive in some path, ie c:\dd, and append it to the system environment variable PATH, and use it.
Jul 30th, 2009 at 12:50 pm