Booting raw (dd) images

Discussions about using Windows guests in VirtualBox.

Booting raw (dd) images

Postby turtle » 20. Feb 2009, 20:13

I am trying to boot an image of a 2-disk WinXP system in VirtualBox. I am doing it forensically so I will be using non-persistent, or snapshot.
I have 2 dd files: hda.dd and hdb.dd

I can try first using:
vboxmanage convertfrom raw hda.dd hda.dd.vdi
vboxmanage convertfrom raw hdb.dd hdb.dd.vdi

But the files are several hundred gigabytes each so that conversion will takes several hours and several hundred gigabytes of disk space.

VirtualBox can boot VM .vdmk files, so it MUST be able to understand the VMware style monolithicFlat files that just reference an existing raw data image. But the virtualbox tools have no way to specify using an existing raw data image. I must either create the .vdmk description file in VMware style (I don't know how to get the head/cylinder/sectors right), or mount the image files to my Windows system first - but this is forensic so I don't want to let Windows get it's sloppy hands all over the data, which it does when mounting anything.

Is there any way to tell virtualbox to use a raw data file directly?
This seems like it should be easy. The functionality must be in virtualbox already in order to use VMware files.

-T
turtle
 
Posts: 2
Joined: 20. Feb 2009, 20:04

Postby TerryE » 22. Feb 2009, 01:01

Search the user guide for createrawvmdk and read the section.
Read the Forum Posting Guide
Google your Q site:VirtualBox.org or search for the answer before posting.
TerryE
Site Moderator
 
Posts: 3572
Joined: 28. May 2008, 08:40
Primary OS: Ubuntu other
VBox Version: PUEL
Guest OSses: Ubuntu 10.04 & 11.10, both Svr&Wstn, Debian, CentOS

Postby elifarley » 22. Feb 2009, 17:26

TerryE wrote:Search the user guide for createrawvmdk and read the section.

All references to createrawvmdk I could find use raw disks or raw disk partitions, not raw disk images.

Anyways, I've tried this:
Code: Select all   Expand viewCollapse view
VBoxManage internalcommands createrawvmdk -filename /tmp/test-1.vmdk -rawfile /tmp/ad2s1a.dd

But it only resulted in an error message:
Code: Select all   Expand viewCollapse view
Syntax error: Invalid parameter '-rawfile'

I've also tried this:
Code: Select all   Expand viewCollapse view
VBoxManage internalcommands createrawvmdk -filename /tmp/test-1.vmdk -rawdisk /tmp/ad2s1a.dd

which resulted in another error message:
Code: Select all   Expand viewCollapse view
File '/tmp/ad2s1a.dd' is no block device

This suggests that access to raw image files is not readily available right now.

Since I could get no cooperation from VirtualBox, I was forced to use these commands to gain access to my raw image files:
Code: Select all   Expand viewCollapse view
> su -
> modprobe loop
> losetup /dev/loop0 /tmp/ad2s1a.dd
> VBoxManage internalcommands createrawvmdk -filename /tmp/test-1.vmdk -rawdisk /dev/loop0
> chmod a+rw /tmp/test-1.vmdk
> usermod -a -G disk <your-login>

(You'll have to completely logout after issuing 'usermod' in order to have r/w access to /dev/loop0)

Hope that helps.

Cheers,
Elifarley
elifarley
 
Posts: 4
Joined: 10. Aug 2007, 04:17
Location: Brazil

Postby Sasquatch » 22. Feb 2009, 20:30

Try VBoxManage internalcommands convertfromraw.
Read the Forum Posting Guide before opening a topic.
VirtualBox FAQ: Check this before asking questions.
Online User Manual: A must read if you want to know what we're talking about.
Howto: Install Linux Guest Additions
Howto: Use Shared Folders on Linux Guest
See the Tutorials and FAQ section at the top of the Forum for more guides.
Try searching the forums first with Google and add the site filter for this forum.
E.g. install guest additions site:forums.virtualbox.org

Retired from this Forum since OSSO introduction.
Sasquatch
Volunteer
 
Posts: 17800
Joined: 17. Mar 2008, 13:41
Location: /dev/random
Primary OS: Debian other
VBox Version: PUEL
Guest OSses: Windows XP, Windows 7, Linux

Postby eviltwin » 22. Feb 2009, 20:53

Sasquatch wrote:Try VBoxManage internalcommands convertfromraw.

I think he stated that this would take way too long because the files are several hundred gigabytes
eviltwin
 
Posts: 32
Joined: 22. Feb 2009, 04:55
Location: England

Postby Sasquatch » 22. Feb 2009, 20:57

Right, forgot about that. I answer a lot of posts each day, so I tend to forget a few situations.

I guess there is no other solution. If he used the convertfromraw, he probably would have been done by now.
Read the Forum Posting Guide before opening a topic.
VirtualBox FAQ: Check this before asking questions.
Online User Manual: A must read if you want to know what we're talking about.
Howto: Install Linux Guest Additions
Howto: Use Shared Folders on Linux Guest
See the Tutorials and FAQ section at the top of the Forum for more guides.
Try searching the forums first with Google and add the site filter for this forum.
E.g. install guest additions site:forums.virtualbox.org

Retired from this Forum since OSSO introduction.
Sasquatch
Volunteer
 
Posts: 17800
Joined: 17. Mar 2008, 13:41
Location: /dev/random
Primary OS: Debian other
VBox Version: PUEL
Guest OSses: Windows XP, Windows 7, Linux

Postby TerryE » 22. Feb 2009, 21:07

Sorry, I took the losetup bit as a given. If I had realised that you were a Linux newbie then I would have spelt it out.
Read the Forum Posting Guide
Google your Q site:VirtualBox.org or search for the answer before posting.
TerryE
Site Moderator
 
Posts: 3572
Joined: 28. May 2008, 08:40
Primary OS: Ubuntu other
VBox Version: PUEL
Guest OSses: Ubuntu 10.04 & 11.10, both Svr&Wstn, Debian, CentOS

Postby eviltwin » 22. Feb 2009, 21:08

Sasquatch wrote:If he used the convertfromraw, he probably would have been done by now.

He also might have been out of disk space :wink:

Elifarley's solution looks workable... just need to the OP to try it and we can move from there...
eviltwin
 
Posts: 32
Joined: 22. Feb 2009, 04:55
Location: England

loopback

Postby turtle » 23. Feb 2009, 18:27

The OP is stuck on a Windows platform. No loopback for me.

I can try it with MountImage Pro or some similar tool. I'll just have to be very careful about making sure it's write protected from the instant it gets mounted, or as I said, Windows will gladly scribble all over some timestamps.

---

Ok, I got it worked by hand crafting a VMware .vdmk file. It wasn't easy, I had to get the cylinders, heads, sectors to a (make believe) number that worked.
Not a user-friendly solution, but it works.
turtle
 
Posts: 2
Joined: 20. Feb 2009, 20:04

Postby TerryE » 23. Feb 2009, 19:37

Sorry about the Windows issue, but we all have things to bear. I actually find XP a usable desktop solution for my Laptop, but really prefer Linux for any serious development and server work.

If you do get around to documenting what you did to the VMDK file in more detail, then I'd find this useful.
Read the Forum Posting Guide
Google your Q site:VirtualBox.org or search for the answer before posting.
TerryE
Site Moderator
 
Posts: 3572
Joined: 28. May 2008, 08:40
Primary OS: Ubuntu other
VBox Version: PUEL
Guest OSses: Ubuntu 10.04 & 11.10, both Svr&Wstn, Debian, CentOS

Re: Booting raw (dd) images

Postby gida » 8. Dec 2009, 21:14

Hi

A bit late, but I think this could be of interest for many Users.

If you are trying to boot raw dd, EWF or AFF images in VB, you may use my GPL'ed program entitled xmount (https://www.pinguin.lu).
It allows you to convert on-the-fly between the above formats and a VDI or VMDK file. All changes to the virtual file are written to a separate cache file in order to not modify the original image file.

Prebuild packages of xmount for any Debian based Linux are provided and no, it won't run under Windows :)

And if you plan to boot a Micro$oft os, you should probably have a look at my other project entitled OpenGates that will patch Windows in order to boot in your virtual machine.

cya
gida
 
Posts: 1
Joined: 8. Dec 2009, 21:04
Primary OS: Debian other
VBox Version: PUEL
Guest OSses: WinXP

Re: Booting raw (dd) images

Postby mpack » 8. Dec 2009, 22:50

IMHO, the easiest way to turn a raw disk image (even if segmented) into a usable virtual disk format is to use a text editor to create a little VMDK descriptor for the raw images. Look at the root .vmdk file for any VMDK disk and you'll see how. VMDKs come in several flavours, sometimes the descriptor is embedded in the disk image, sometimes it's a additional text file readily identified (despite all files in the set having the same .vmdk extension) because the descriptor file will be much smaller than the others - it's the latter style of VMDK you need to use as an example.

No time consuming conversion required, just create the descriptor and mount it directly in VBox or anything else that understands VMDKs.
mpack
Site Moderator
 
Posts: 13199
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows XP
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Booting raw (dd) images

Postby kitrule » 22. Nov 2010, 04:24

Thanks for the guide.
You can bypass logging out and back in by executing "newgrp disk" after "usermod -a -G disk <your-login>" then reloading VirtualBox from that shell/terminal.
kitrule
 
Posts: 3
Joined: 6. Dec 2007, 22:54


Return to Windows Guests

Who is online

Users browsing this forum: Yahoo [Bot] and 8 guests