Free Software

Tools made by Bradley Schatz related to his research, and made freely available.

dd2vmdk P2V

dd2vmdk is an online Physical-to-Virtual (P2V) conversion tool, useful in converting images of physical hard disk drives to bootable VMWare virtual disks.

While there are many other methods for converting a disk image into an image bootable in VMWare (such as the excellent, and similarly free LiveView), this approach is distinguished by (a) requiring no software to be installed and (b) supports non standard disk configurations often found in server class systems. These include non standard disk geometries created by RAID implementations, and the Windows Logical Disk Manager (LDM) partitioning scheme.

If you are trying to convert a DD image to a virtual machine using Live View, and are having problems, try this instead - you could be running into the geometry problems that this solves.

Pasco2

Pasco2 is a forensic tool for decoding the web history and cache records produced by Microsoft's Internet Explorer.

This was written as an alternative parser in response to finding bugs in the original (and "C" based Pasco) utility, and adds additional metadata fields not supported in the original. I developed this tool to support my doctoral research looking at temporal correlation. A peer reviewed publication resulting from this work 'Establishing temporal provenance of computer event log evidence' is avaliable on my publications page.

return to top