search

dellastreet / NBD-SparseImager

A disk imaging solution for creating partial, sparse, binary images of windows machines for forensic analysis.
2 stars 0 forks source link

TODO: integration with QEMU #19

Open dellastreet opened 14 years ago

dellastreet commented 14 years ago

It seems possible to export the local nbd proxy using NBD to a QEMU client or using ISCSI to a VMWare client

dellastreet commented 14 years ago

Prototype works: this evening I booted my Laptops XP (that was running!) using a xndb-server --cow (copy-on-write) to a local QEMU machine.

Preferably the xnbd would keep 2 sparse files! One for the read data and a second one for the overwritten data. This would keep the read data forensicly clean.