Problems Importing VMDK image into EnCase Forensic 20.4
I have a 22GB VMDK image file that I tried to import into EnCase Forensic 20.4.0.120. After adding the image file, it only shows Unused Disk Area. No partitions, or volumes. I scanned for LVM under device as well as ran Audit Drive Space Results EnScript to no effect. I also tired to mount the VMDK volume using FTK Imager Mount feature and the volume still comes up as Unused Disk Space.
Is there anything else that I missed? I do not have a VMX file associated with this VMDK image nor do I have access to VMWARE software at this point to mount the image natively.
Any thoughts or feedback is welcome.
0
Comments
I am also having the same issue with EnCase EI 21.2.
I have several VMDK files that when dropped in EnCase evidence show as Unused Disk. However, I can mount them all in FTK imager and see the structure. I then export image from FTK Imager and drop the E01 in EnCase and still unused disk area. I have also tried in EnCase Imager.
I did get a couple to work by mounting the image with FTK Imager as physical device then pull the physical device into EnCase and then image from there. I always dump vmdks in with no issue. The ones I am having trouble with are preallocated VMDKs. Not sure if that is an issue,