• PCs_virtualisieren
• Workshop_IMF_2007
• Handout

IMF 2007 - 13.09.2007 - Workshop 5 "Virtualization of forensic Images"

1. Documentation

The whole presentation including extra information will be available soon at the IMF project-pages

• http://www.gi-ev.de/fachbereiche/sicherheit/fg/sidar/imf/imf2007/program.html

Almost all examples uses based on the training evidence-file "Hacking Case" from the CFReDS Project

• http://www.cfreds.nist.gov/

  • http://www.cfreds.nist.gov/Hacking_Case.html

2. Part one: Using Live View

Ralf Moll
Landeskriminalamt Baden-Württemberg
E-Mail: ralf.moll@lka.bwl.de
http://www.polizei-bw.de/lka/

2.1. Used Software

• Mount Image Pro for mounting image files

  • http://www.mountimage.com/

• FTK-Imager for converting image files

  • http://www.accessdata.com/catalog/partdetail.aspx?partno=11300

• LibEWF for converting image files

  • https://www.uitwisselplatform.nl/projects/libewf/

• Live View for creating virtual machines

  • http://liveview.sourceforge.net/

• VMware Workstation v5

  • http://www.vmware.com/products/ws/

2.2. Documentation

The presentation is based on wiki technology, so you can work with the papers

• http://en.wikipedia.org/wiki/Wiki

• http://moinmo.in/ Desktop Edition (http://moinmo.in/DesktopEdition)

3. Part two: Using VFC

Holger Morgenstern
Öffentlich bestellter u. vereidigter EDV-Sachverständiger für Computerforensik
E-Mail: holger@morgenstern.net
http://www.gutachten.info/

3.1. Used Software

• Mount Image Pro for mounting image files

  • http://www.mountimage.com/

• VMware's free Disk Mount utility:

  • http://www.vmware.com/download/eula/diskmount_ws_v55.html

• VMware's free player

  • http://www.vmware.com/download/player/

• VFC

  • http://www.mountimage.com/virtual-forensic-computing-vfc.php

3.2. Documentation

You can find updated information on

• http://www.computerforensik.net/vfc.html