Year: 2004

The old method of booting the target’s machine consisted of cloning the target’s drive with Safeback, then installing it into a sterile computer or the suspect’s computer. I never liked the former method because of hardware issues and I never liked the latter because I like to touch the target machine as little as possible. All this hassle, not to mention I would still have to image the suspect’s computer again in order to do my forensic examination.

Is there a solution? I have found a solution that simplifies and speeds up the process. I am utilizing Linux, VMware for Linux, and SMART. Just what is Linux, VMware for Linux, and SMART? Well, as you all know, Linux is an operating system. What few people realize is just how powerful this operating system is when it comes to computer forensic work. VMware for Linux is a software package that enables you to create a virtual computer within your Linux operating system. SMART is a graphical computer forensic tool written for the Linux operating system. Why SMART? You will see later in this paper when I discuss the imaging capabilities of SMART. These capabilities make it probably the best imaging tool I’ve seen to date, not to mention the computer forensic tools built in to SMART.

This document lists steps required to create a virtual machine in VMWare
from an existing physical machine. These instructions were originally
written for the VMWare ESX Server product, but have been tested and verified
by the writer on one single conversion in VMWare Workstation v4.0. The
information herein was originally found on the VMWare newsgroup
(news.vmware.com) under the ESX Server product in a thread that begins with
“Norton Ghost.” There is still some valuable information out there the
reader wishes to do more research. Original instructions called for using a
“Ghost cast floppy via x-over” to create and restore the image of the
physical machine. However, this document will go from the perspective of
having a ghosted image on CD or DVD, which is how we image our systems for
duplication. The process is described in summary below, and subsequently in
full detail. Note that the writer makes no guarantees as to the accuracy of
the information herein, but is simply communicating how this has worked on
one occasion.

————————————
————————————

High-level Process Overview:

1. Obtain a bootable CD or DVD that contains the image you wish to
convert.

2. Create a new MS-DOS virtual machine of the correct size (i.e., at
least the same size as the physical partition that was Ghosted) and boot it
from the Ghosted CD or DVD.

3. Restore the Ghosted image to your new virtual machine.

4. Configure another virtual machine with the same operating system as
the one you just restored from the Ghosted image.

5. Boot another virtual machine with the same operating system as the
one you just restored from the Ghosted image

6. Boot the virtual machine you just created.

————————————
————————————

Detailed Instructions:

These instructions assume that a Ghosted image already exists on a bootable
CD or DVD. You will also need an existing virtual machine with the same
operating system as the image you wish to convert. For example, if you have
an image of Windows 2000 Advanced Server, you will need an existing
installation of Windows 2000 Advanced Server on VMWare. In addition, this
assumes that the image you are converting has been created with an IDE
drive. Converting SCSI drives is very complicated and not within the scope
of this article. Please read and execute these instructions carefully, as
each step within depends on successful completion of the previous step!

————————————

1. Obtain a bootable CD or DVD that contains the image you wish to
convert.

————————————

2. Create a new MS-DOS virtual machine of the correct size and boot it
from the Ghosted CD or DVD.

2.1. Start VMWare

2.2. Go to the File menu, choose New, then New Virtual Machine and click
Next.

2.3. Click Custom, then Next.

2.4. Under Guest Operating System, choose MS-DOS. This is important
because VMWare will look at this virtual machine as an IDE drive. Again,
attempts to convert a SCSI image did not work in this scenario. I am not
sure why.

2.5. Under Virtual Machine Name, choose a name for the virtual machine you
will ultimately be using after conversion.

2.6. Next, choose how much memory you wish to allocate to the virtual
machine you will ultimately be using after conversion. Note that these
numbers can be changed by the individual user based on how much memory they
will use keeping in mind how much physical RAM they have.

2.7. Click Next.

2.8. Under Network connection, choose Use bridged networking and click
Next.

2.9. Click Create a new virtual disk and click Next.

2.10. Under Specify Disk Capacity, you need to specify,
in gigabytes, how large to make the new disk. Note that you need to make
the disk size at least as large as the image you are about to restore, and
also need at least as much free space as you specify to allocate.

2.11. Click Allocate all disk space now and click Next. A
warning message will appear asking if you’re sure that’s what you want to
do. Be sure you have enough free space to create that size of a file.

2.12. Click OK to clear the warning message and allocate
the disk space.

————————————

3. Restore the Ghosted image to your new virtual machine.

3.1. With the virtual machine powered off, place the DVD or CD with the
image you want to restore into the DVD drive.

3.2. Boot the virtual machine.

3.3. Follow the instructions onscreen to boot from the CD/DVD ROM drive.

3.4. Follow the instructions to restore the image from CD/DVD onto the
virtual hard drive.

3.5. When imaging is complete, shut down the virtual machine and remove
the CD/DVD from the drive.

————————————

4. Configure another virtual machine with the same operating system as
the one you just restored from the Ghosted image (assumes you already have
another virtual machine with the same OS installed).

4.1. In VMWare, select the virtual machine that has the same operating
system as the one you just restored from Ghost.

4.2. Go to the Edit menu and choose Virtual Machine Settings.

4.3. Click the Add button and click Next.

4.4. Choose Hard Disk and click Next.

4.5. Click Use an existing virtual disk and click Next.

4.6. Use the Browse button to navigate to the VMDK file for the image you
created. For example My Data\My Virtual Machines\Test\Test.vmdk.

4.7. Click OK. The new virtual hard disk will be added.

————————————

5. Boot another virtual machine with the same operating system as the
one you just restored from the Ghosted image. This will allow you to add
the appropriate HAL.DLL file to the virtual machine, thus enabling it to
boot in VMWare.

5.1. Boot the virtual machine to which you just added the new virtual hard
disk.

5.2. Log into the virtual machine as an administrator.

5.3. On the Windows desktop, right-click My Computer and choose Manage.

5.4. Click Disk Management. You should see a disk in the right window
pane for the virtual hard drive you just added.

5.5. Right-click the new hard drive and choose Change drive letter and
paths.

5.6. Assign a driver letter to it (e.g., Z:).

5.7. In the virtual machine you are currently running, navigate to the
system drive\WINNT\system32 folder.

5.8. Search for the HAL.DLL file and copy it to the clipboard.

5.9. Navigate to Z:\WINNT\system32.

5.10. Rename the existing HAL.DLL there to HAL.dll.old.

5.11. Paste the HAL.DLL from the currently running
virtual machine in the Z:\WINNT\system32 folder.

5.12. Go to the Start menu and choose shut down to turn
off the virtual machine.

————————————

6. Boot the virtual machine to which you just created and copied the
appropriate HAL.DLL file. At this point, the virtual machine you created
from the Ghosted image should boot correctly with a minimum configuration
(i.e., no sound, 640×480 resolution, etc.). From here, you will need to
install the VMWare tools in the new operating system.

6.1. In VMWare, select your new virtual machine.

6.2. Go to the Edit menu and choose Virtual Machine Settings.

6.3. Click the Options tab.

6.4. Under Guest Operating System, change it to read the correct OS you
restored from the ghosted image (e.g., Windows 2000Advanced Server). This
is very important, as the next steps will not work properly if you choose
the wrong OS.

6.5. Click OK.

6.6. Click Start this virtual machine.

6.7. Give the virtual machine time to boot and log in as an administrator.

6.8. If you see any plug and play messages at this point telling you to
install new hardware, ignore them.

6.9. Once the machine is booted and the new hard ware massages are gone,
go to the File menu in VMWare and choose Install VMWare Tools.

6.10. Follow the instructions to complete the
installation of the VMWare Tools. This will tell the operating system which
virtual hardware drivers to use so it can talk to the host operating system.

6.11. After the installation of the VMWare tools, you
will be prompted to restart. It is a good idea to do so at this point.

A chip technology that will be available within five years, code-named Vanderpool, will allow users to partition the processor inside their computers. In a demonstration, Otellini used a PC to beam an episode of “The Simpsons” to a plasma TV, while another Intel executive booted and rebooted a game with the same machine.

“What we are doing is creating virtual machines inside the microprocessor,” Otellini said. “You can run multiple versions of Windows or different operating systems.”

Conversely, Intel will release Montecito, an Itanium chip that will be Intel’s first dual-core processor, in 2005 and follow it with Tanglewood, a future version of the Itanium family of chips for servers that will contain multiple cores.