Booting raw (dd) images

[turtle]

I am trying to boot an image of a 2-disk WinXP system in VirtualBox. I am doing it forensically so I will be using non-persistent, or snapshot.
I have 2 dd files: hda.dd and hdb.dd

I can try first using:
vboxmanage convertfrom raw hda.dd hda.dd.vdi
vboxmanage convertfrom raw hdb.dd hdb.dd.vdi

But the files are several hundred gigabytes each so that conversion will takes several hours and several hundred gigabytes of disk space.

VirtualBox can boot VM .vdmk files, so it MUST be able to understand the VMware style monolithicFlat files that just reference an existing raw data image. But the virtualbox tools have no way to specify using an existing raw data image. I must either create the .vdmk description file in VMware style (I don't know how to get the head/cylinder/sectors right), or mount the image files to my Windows system first - but this is forensic so I don't want to let Windows get it's sloppy hands all over the data, which it does when mounting anything.

Is there any way to tell virtualbox to use a raw data file directly?
This seems like it should be easy. The functionality must be in virtualbox already in order to use VMware files.

-T

[TerryE]

Search the user guide for createrawvmdk and read the section.

[elifarley]

Search the user guide for createrawvmdk and read the section.

All references to createrawvmdk I could find use raw disks or raw disk partitions, not raw disk images.

Anyways, I've tried this:

Code: Select all   Expand viewCollapse view

VBoxManage internalcommands createrawvmdk -filename /tmp/test-1.vmdk -rawfile /tmp/ad2s1a.dd

But it only resulted in an error message:

Code: Select all   Expand viewCollapse view

Syntax error: Invalid parameter '-rawfile'

I've also tried this:

Code: Select all   Expand viewCollapse view

VBoxManage internalcommands createrawvmdk -filename /tmp/test-1.vmdk -rawdisk /tmp/ad2s1a.dd

which resulted in another error message:

Code: Select all   Expand viewCollapse view

File '/tmp/ad2s1a.dd' is no block device

This suggests that access to raw image files is not readily available right now.

Since I could get no cooperation from VirtualBox, I was forced to use these commands to gain access to my raw image files:

Code: Select all   Expand viewCollapse view

> su -
> modprobe loop
> losetup /dev/loop0 /tmp/ad2s1a.dd
> VBoxManage internalcommands createrawvmdk -filename /tmp/test-1.vmdk -rawdisk /dev/loop0
> chmod a+rw /tmp/test-1.vmdk
> usermod -a -G disk <your-login>

(You'll have to completely logout after issuing 'usermod' in order to have r/w access to /dev/loop0)

Hope that helps.

Cheers,
Elifarley

[Sasquatch]

Try VBoxManage internalcommands convertfromraw.

[eviltwin]

Try VBoxManage internalcommands convertfromraw.

I think he stated that this would take way too long because the files are several hundred gigabytes

[Sasquatch]

Right, forgot about that. I answer a lot of posts each day, so I tend to forget a few situations.

I guess there is no other solution. If he used the convertfromraw, he probably would have been done by now.

[TerryE]

Sorry, I took the losetup bit as a given. If I had realised that you were a Linux newbie then I would have spelt it out.

[eviltwin]

If he used the convertfromraw, he probably would have been done by now.

He also might have been out of disk space

Elifarley's solution looks workable... just need to the OP to try it and we can move from there...

[turtle]

The OP is stuck on a Windows platform. No loopback for me.

I can try it with MountImage Pro or some similar tool. I'll just have to be very careful about making sure it's write protected from the instant it gets mounted, or as I said, Windows will gladly scribble all over some timestamps.

---

Ok, I got it worked by hand crafting a VMware .vdmk file. It wasn't easy, I had to get the cylinders, heads, sectors to a (make believe) number that worked.
Not a user-friendly solution, but it works.

[TerryE]

Sorry about the Windows issue, but we all have things to bear. I actually find XP a usable desktop solution for my Laptop, but really prefer Linux for any serious development and server work.

If you do get around to documenting what you did to the VMDK file in more detail, then I'd find this useful.

[gida]

Hi

A bit late, but I think this could be of interest for many Users.

If you are trying to boot raw dd, EWF or AFF images in VB, you may use my GPL'ed program entitled xmount (https://www.pinguin.lu).
It allows you to convert on-the-fly between the above formats and a VDI or VMDK file. All changes to the virtual file are written to a separate cache file in order to not modify the original image file.

Prebuild packages of xmount for any Debian based Linux are provided and no, it won't run under Windows

And if you plan to boot a Micro$oft os, you should probably have a look at my other project entitled OpenGates that will patch Windows in order to boot in your virtual machine.

cya

[mpack]

IMHO, the easiest way to turn a raw disk image (even if segmented) into a usable virtual disk format is to use a text editor to create a little VMDK descriptor for the raw images. Look at the root .vmdk file for any VMDK disk and you'll see how. VMDKs come in several flavours, sometimes the descriptor is embedded in the disk image, sometimes it's a additional text file readily identified (despite all files in the set having the same .vmdk extension) because the descriptor file will be much smaller than the others - it's the latter style of VMDK you need to use as an example.

No time consuming conversion required, just create the descriptor and mount it directly in VBox or anything else that understands VMDKs.

[kitrule]

Thanks for the guide.
You can bypass logging out and back in by executing "newgrp disk" after "usermod -a -G disk <your-login>" then reloading VirtualBox from that shell/terminal.