Convert RAW image to VDI/VMDK (VirtualBox/VMWare)

In some forensics cases it is necessary to directly boot a HDD evidence to analyze a certain operating system behavior in a “realtime” way.

Before you take this step make sure that you really have collected all volatile data and have 1-2 bitcopy images or a clone of the HDD evidence…just in case of.

Convert RAW to VDI
VBoxManage convertdd SOURCE.raw DESTINATION.vdi --format VDI

Convert RAW to VMDK
VBoxManage convertdd SOURCE.raw DESTINATION.vmdk --format VMDK

Convert VDI to RAW
VBoxManage clonehd SOURCE.vdi DESTINATION.raw --format RAW

Convert VMDK to RAW
VBoxManage clonehd SOURCE.vmdk DESTINATION.raw --format RAW

Leave a Reply