Home› General

Problems Importing VMDK image into EnCase Forensic 20.4

Respond
JCSFJCSF
in General #1

I have a 22GB VMDK image file that I tried to import into EnCase Forensic 20.4.0.120. After adding the image file, it only shows Unused Disk Area. No partitions, or volumes. I scanned for LVM under device as well as ran Audit Drive Space Results EnScript to no effect. I also tired to mount the VMDK volume using FTK Imager Mount feature and the volume still comes up as Unused Disk Space.

Is there anything else that I missed? I do not have a VMX file associated with this VMDK image nor do I have access to VMWARE software at this point to mount the image natively.

Any thoughts or feedback is welcome.

Comments

  • djpeckdjpeck
    #2

    I am also having the same issue with EnCase EI 21.2.

    I have several VMDK files that when dropped in EnCase evidence show as Unused Disk. However, I can mount them all in FTK imager and see the structure. I then export image from FTK Imager and drop the E01 in EnCase and still unused disk area. I have also tried in EnCase Imager.

    I did get a couple to work by mounting the image with FTK Imager as physical device then pull the physical device into EnCase and then image from there. I always dump vmdks in with no issue. The ones I am having trouble with are preallocated VMDKs. Not sure if that is an issue,

Sign In or Register to comment.