Virtual E01 & OSF7

[Maridal74]

Hi everybody,

First question, i'm french, i'll try to be clear...

At first, Thank you for this v7, I've just begun to discover it, but I think it will be a great new version.

But i've already a question :

Is it possible to mount a virtual machine with E01 files, and once launched, use a OSF live on USB Drive ?

Thanks for your answer(s)

[David (PassMark)]

Yes, it should be technically possible, provided your preferred VM host supports USB.

But the real question is, does it make any sense? And I think the answer here is no it doesn't (mostly).

If you boot a E01 image into a VM, then it isn't the same as having access to the original live machine. As all the contents of the RAM from the original machine are gone. So you only have what was on the disk. And if you are only looking at what was on the disk, then in most cases you are problem better off just loading the E01 into OSF and then doing whatever you need to do. Performance will be better doing this as you don't have USB involved, you don't have VMWare involved and you don't have a virtual physical disk emulation layer + disk caching involved.

But there is no reason that you can't use both methods. Do the quick visual stuff in the VM (e.g. checking what was on the desktop, checking WIn10 timeline, etc..), then do the slower more disk intensive operations outside of the VM (like disk indexing).

If you were dealing with a lot of NTFS EFS encrypted files, and had the Windows password that you could enter at boot, then VM booting might provide an easier method to preview a large set of those file types.