Convert RAW image to VDI/VMDK (VirtualBox/VMWare)

In some forensics cases it is necessary to directly boot a HDD evidence to analyze a certain operating system behavior in a “realtime” way. Before you take this step make sure that you really have collected all volatile data and have 1-2 bitcopy images or a clone of the HDD evidence…just in case of. Convert RAW to VDI VBoxManage convertdd SOURCE.raw DESTINATION.vdi –format VDI Convert RAW to VMDK VBoxManage convertdd SOURCE.raw DESTINATION.vmdk –format VMDK Convert VDI to RAW VBoxManage clonehd SOURCE.vdi DESTINATION.raw –format RAW Convert VMDK to RAW VBoxManage clonehd SOURCE.vmdk DESTINATION.raw –format RAW

Continue reading »