Booting raw (dd) images

Discussions about using Windows guests in VirtualBox.
Post Reply
turtle
Posts: 2
Joined: 20. Feb 2009, 20:04

Booting raw (dd) images

Post by turtle »

I am trying to boot an image of a 2-disk WinXP system in VirtualBox. I am doing it forensically so I will be using non-persistent, or snapshot.
I have 2 dd files: hda.dd and hdb.dd

I can try first using:
vboxmanage convertfrom raw hda.dd hda.dd.vdi
vboxmanage convertfrom raw hdb.dd hdb.dd.vdi

But the files are several hundred gigabytes each so that conversion will takes several hours and several hundred gigabytes of disk space.

VirtualBox can boot VM .vdmk files, so it MUST be able to understand the VMware style monolithicFlat files that just reference an existing raw data image. But the virtualbox tools have no way to specify using an existing raw data image. I must either create the .vdmk description file in VMware style (I don't know how to get the head/cylinder/sectors right), or mount the image files to my Windows system first - but this is forensic so I don't want to let Windows get it's sloppy hands all over the data, which it does when mounting anything.

Is there any way to tell virtualbox to use a raw data file directly?
This seems like it should be easy. The functionality must be in virtualbox already in order to use VMware files.

-T
TerryE
Volunteer
Posts: 3572
Joined: 28. May 2008, 08:40
Primary OS: Ubuntu other
VBox Version: PUEL
Guest OSses: Ubuntu 10.04 & 11.10, both Svr&Wstn, Debian, CentOS
Contact:

Post by TerryE »

Search the user guide for createrawvmdk and read the section.
Read the Forum Posting Guide
Google your Q site:VirtualBox.org or search for the answer before posting.
elifarley
Posts: 9
Joined: 10. Aug 2007, 04:17
Location: Brazil

Post by elifarley »

TerryE wrote:Search the user guide for createrawvmdk and read the section.
All references to createrawvmdk I could find use raw disks or raw disk partitions, not raw disk images.

Anyways, I've tried this:

Code: Select all

VBoxManage internalcommands createrawvmdk -filename /tmp/test-1.vmdk -rawfile /tmp/ad2s1a.dd
But it only resulted in an error message:

Code: Select all

Syntax error: Invalid parameter '-rawfile'
I've also tried this:

Code: Select all

VBoxManage internalcommands createrawvmdk -filename /tmp/test-1.vmdk -rawdisk /tmp/ad2s1a.dd
which resulted in another error message:

Code: Select all

File '/tmp/ad2s1a.dd' is no block device
This suggests that access to raw image files is not readily available right now.

Since I could get no cooperation from VirtualBox, I was forced to use these commands to gain access to my raw image files:

Code: Select all

> su -
> modprobe loop
> losetup /dev/loop0 /tmp/ad2s1a.dd
> VBoxManage internalcommands createrawvmdk -filename /tmp/test-1.vmdk -rawdisk /dev/loop0
> chmod a+rw /tmp/test-1.vmdk
> usermod -a -G disk <your-login>
(You'll have to completely logout after issuing 'usermod' in order to have r/w access to /dev/loop0)

Hope that helps.

Cheers,
Elifarley
Sasquatch
Volunteer
Posts: 17798
Joined: 17. Mar 2008, 13:41
Primary OS: Debian other
VBox Version: PUEL
Guest OSses: Windows XP, Windows 7, Linux
Location: /dev/random

Post by Sasquatch »

Try VBoxManage internalcommands convertfromraw.
Read the Forum Posting Guide before opening a topic.
VirtualBox FAQ: Check this before asking questions.
Online User Manual: A must read if you want to know what we're talking about.
Howto: Install Linux Guest Additions
Howto: Use Shared Folders on Linux Guest
See the Tutorials and FAQ section at the top of the Forum for more guides.
Try searching the forums first with Google and add the site filter for this forum.
E.g. install guest additions site:forums.virtualbox.org

Retired from this Forum since OSSO introduction.
eviltwin
Posts: 32
Joined: 22. Feb 2009, 04:55
Location: England

Post by eviltwin »

Sasquatch wrote:Try VBoxManage internalcommands convertfromraw.
I think he stated that this would take way too long because the files are several hundred gigabytes
Sasquatch
Volunteer
Posts: 17798
Joined: 17. Mar 2008, 13:41
Primary OS: Debian other
VBox Version: PUEL
Guest OSses: Windows XP, Windows 7, Linux
Location: /dev/random

Post by Sasquatch »

Right, forgot about that. I answer a lot of posts each day, so I tend to forget a few situations.

I guess there is no other solution. If he used the convertfromraw, he probably would have been done by now.
Read the Forum Posting Guide before opening a topic.
VirtualBox FAQ: Check this before asking questions.
Online User Manual: A must read if you want to know what we're talking about.
Howto: Install Linux Guest Additions
Howto: Use Shared Folders on Linux Guest
See the Tutorials and FAQ section at the top of the Forum for more guides.
Try searching the forums first with Google and add the site filter for this forum.
E.g. install guest additions site:forums.virtualbox.org

Retired from this Forum since OSSO introduction.
TerryE
Volunteer
Posts: 3572
Joined: 28. May 2008, 08:40
Primary OS: Ubuntu other
VBox Version: PUEL
Guest OSses: Ubuntu 10.04 & 11.10, both Svr&Wstn, Debian, CentOS
Contact:

Post by TerryE »

Sorry, I took the losetup bit as a given. If I had realised that you were a Linux newbie then I would have spelt it out.
Read the Forum Posting Guide
Google your Q site:VirtualBox.org or search for the answer before posting.
eviltwin
Posts: 32
Joined: 22. Feb 2009, 04:55
Location: England

Post by eviltwin »

Sasquatch wrote:If he used the convertfromraw, he probably would have been done by now.
He also might have been out of disk space :wink:

Elifarley's solution looks workable... just need to the OP to try it and we can move from there...
turtle
Posts: 2
Joined: 20. Feb 2009, 20:04

loopback

Post by turtle »

The OP is stuck on a Windows platform. No loopback for me.

I can try it with MountImage Pro or some similar tool. I'll just have to be very careful about making sure it's write protected from the instant it gets mounted, or as I said, Windows will gladly scribble all over some timestamps.

---

Ok, I got it worked by hand crafting a VMware .vdmk file. It wasn't easy, I had to get the cylinders, heads, sectors to a (make believe) number that worked.
Not a user-friendly solution, but it works.
TerryE
Volunteer
Posts: 3572
Joined: 28. May 2008, 08:40
Primary OS: Ubuntu other
VBox Version: PUEL
Guest OSses: Ubuntu 10.04 & 11.10, both Svr&Wstn, Debian, CentOS
Contact:

Post by TerryE »

Sorry about the Windows issue, but we all have things to bear. I actually find XP a usable desktop solution for my Laptop, but really prefer Linux for any serious development and server work.

If you do get around to documenting what you did to the VMDK file in more detail, then I'd find this useful.
Read the Forum Posting Guide
Google your Q site:VirtualBox.org or search for the answer before posting.
gida
Posts: 1
Joined: 8. Dec 2009, 21:04
Primary OS: Debian other
VBox Version: PUEL
Guest OSses: WinXP

Re: Booting raw (dd) images

Post by gida »

Hi

A bit late, but I think this could be of interest for many Users.

If you are trying to boot raw dd, EWF or AFF images in VB, you may use my GPL'ed program entitled xmount (https://www.pinguin.lu).
It allows you to convert on-the-fly between the above formats and a VDI or VMDK file. All changes to the virtual file are written to a separate cache file in order to not modify the original image file.

Prebuild packages of xmount for any Debian based Linux are provided and no, it won't run under Windows :)

And if you plan to boot a Micro$oft os, you should probably have a look at my other project entitled OpenGates that will patch Windows in order to boot in your virtual machine.

cya
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Booting raw (dd) images

Post by mpack »

IMHO, the easiest way to turn a raw disk image (even if segmented) into a usable virtual disk format is to use a text editor to create a little VMDK descriptor for the raw images. Look at the root .vmdk file for any VMDK disk and you'll see how. VMDKs come in several flavours, sometimes the descriptor is embedded in the disk image, sometimes it's a additional text file readily identified (despite all files in the set having the same .vmdk extension) because the descriptor file will be much smaller than the others - it's the latter style of VMDK you need to use as an example.

No time consuming conversion required, just create the descriptor and mount it directly in VBox or anything else that understands VMDKs.
kitrule
Posts: 3
Joined: 6. Dec 2007, 22:54

Re: Booting raw (dd) images

Post by kitrule »

Thanks for the guide.
You can bypass logging out and back in by executing "newgrp disk" after "usermod -a -G disk <your-login>" then reloading VirtualBox from that shell/terminal.
Post Reply