Showing posts with label vmdk. Show all posts
Showing posts with label vmdk. Show all posts

Saturday, 17 November 2018

Convert VDI image

Some quick notes on virtual machine formats.

There was a VirtualBox VDI file which EnCase and FTK Imager couldn't mount - EnCase v8.05 was unable to even read the partitions while FTK Imager v4.1.1.1 could read the partitions but not the filesystem in the partitions.

Initially I tried to convert to VMDK format using VirtualBox's vboxmanage internalcommands:
vboxmanage internalcommands converthd -srcformat VDI -dstformat VMDK <inputfile> <outputfile>

but it produced the following error:
VBoxManage.exe: error: Cannot copy the image: VERR_VD_INVALID_TYPE


Subsequently, thanks to the post by Namareba食べたい, I successfully converted the image file with the following command:
vboxmanage clonemedium disk <inputfile> <outputfile> --format VMDK

and the resultant VMDK file was read and mounted successfully by EnCase.

Magnet Summit 2022 Virtual CTF - Windows

Magnet Forensics recently concluded their Virtual CTF for the Magnet Summit 2022.  Participants were provided with the following three image...