Connecting a forensics disk image (EnCase .E01, RAW etc.) to a Virtual Machine For connect RAW (.IMG, .DD) or EnCase EWF (.E01) forensic disk image to your VMware Workstation Pro (Player) virtual mashine via Disk Adapter For VMware Workstation you need doing next steps: 1. Set checkbox Connect to VMware Workstation Pro (Connect to VMware Workstation Player).If VMware Workstation Pro (Player) application are running and all its components works good you can see green indicator and caption Connected. Else you can see red indicator and caption Disconnected. Trying to connect.... It means that VMware Workstation Pro (Player) application are not running or some its components wrong. 2. Add disk image using Add disk image button.When your disk image will be addet you can see it in list Control of disk images. (The disk image D:\test\Test Disk Image.E01 on screenshot.) 3. Add the disk image to a virtual machine:
4. Doing operations with the disk image in your virtual machine.Rememper that Disk Adapter For VMware Workstation can work with RAW disk images in read-write mode and with EnCase disk images in read-only mode. 5. Remove the disk image from a virtual machine
6. Shut down Disk Adapter For VMware Workstation.Shut down the program only after removing all disk images that you connected via Disk Adapter For VMware Workstation from the virtual machine. If you will shut down Disk Adapter For VMware Workstation before removing all added disk images you can have errors in VMware Workstation and VMware Workstation can broke. |
||
Other names may be trademarks of their respective owners. |
VMware, Workstation, Pro, Player are registered trademarks of VMware, Inc. in the United States and other countries.