ep: Error: The process cannot access the file

Help
b0dhi911
2010-12-03
2013-04-23
  • b0dhi911
    b0dhi911
    2010-12-03

    I have a WinXP laptop drive dd image that I'm trying to boot in LiveView 0.7b. 

    It looks like the snapshot gets mounted, but that's as far as it goes.  I get a bunch of errors after the snapshot is mounted.  MostRecentRun.log  is below…If anyone can help, please let me know.. thanks!

    ============================START============================
    External Proc Output: ! REG.EXE VERSION 3.0
    HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Virtual Disk Development Kit
        InstallPath REG_SZ C:\Program Files\VMware\VMware Virtual Disk Development Kit\

    External Process Error:
    Live View 0.7b
    Host Operating System: Windows XP
    Java Version: 1.6
    Executing:
    External Proc Output: ! REG.EXE VERSION 3.0
    HKEY_LOCAL_MACHINE\SOFTWARE\VMWare, Inc.
        Core REG_SZ VMware Workstation

    External Process Error:
    Executing:
    External Proc Output: ! REG.EXE VERSION 3.0
    HKEY_LOCAL_MACHINE\SOFTWARE\VMWare, Inc.\VMware Workstation
        ProductVersion REG_SZ 7.0.0.203739

    External Process Error:
    Executing:
    External Proc Output: ! REG.EXE VERSION 3.0
    HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Workstation
        InstallPath REG_SZ C:\Program Files\VMware\VMware Workstation\

    External Process Error:
    VMWare Install Type: 0
    VMWare Mount Path: C:\Program Files\VMware\VMware Virtual Disk Development Kit\bin\vmware-mount.exe
    Executing:
    External Proc Output:
    External Process Error: Error:  The system was unable to find the specified registry key or value

    Ram Size: 512
    System Time: Dec 3, 2010 9:39:32 AM
    Guest OS: auto
    Is Physical Disk: false
    non-numeric or mixed extensions detected
    Sorted Input Files
    vmrun path: C:\Program Files\VMware\VMware Workstation\vmrun.exe
    Mount Drive Letter: m
    MBR Signature found: almost certainly have an mbr or partition (not garbagefile)
    Num Existing Snapshots 1
    Output: Detected VMWare Workstation Installation

    Output: Detected full disk image

    Deleted: data001.dd-000001.vmdk
    Deleted: data001.dd-Snapshot1.vmsn
    Deleted: data001.dd.vmdk
    Deleted: data001.dd.vmsd
    Deleted: data001.dd.vmx
    Deleted: data001.dd.vmxf
    MBR Info:

    fa eb 32 90 a4 01 4c 49 4c 4f 01 00 16 03 00 00
    00 00 00 00 00 00 00 00 ff ff 00 00 00 03 00 00
    00 00 00 00 00 13 35 e0 d7 02 00 e3 35 e0 d7 02
    28 35 e0 d7 02 e8 00 00 58 2d 38 00 8c cf c1 e8
    04 01 f8 8e d0 bc 00 08 fb 52 53 06 56 fc 8e d8
    8e c0 b8 00 12 b3 36 cd 10 b0 0d e8 ae 00 b0 0a
    e8 a9 00 b0 4c e8 a4 00 be 30 00 bb 00 02 53 e8
    54 00 b4 99 66 81 7f fc 4c 49 4c 4f 75 31 5e cd
    12 c1 e0 06 2b 06 1c 00 50 07 31 db e8 37 00 75
    fb be 06 00 89 f7 66 a7 75 13 26 80 3d 02 75 0d
    a7 a7 75 09 b0 49 e8 63 00 06 6a 00 cb b4 9a 51
    59 b0 20 e8 56 00 e8 43 00 31 c0 cd 13 fe 0e 00
    00 75 a5 f4 eb fd ad 91 ac a8 60 75 0f 4e ad 89
    c2 09 c8 74 26 ac b4 02 cd 13 eb 1a 92 ad f6 c2
    20 75 02 30 e4 97 f6 c2 10 74 08 03 0e 10 00 13
    3e 12 00 e8 22 00 72 b8 80 c7 02 c3 c1 c0 04 e8
    03 00 c1 c0 04 24 0f 27 04 f0 14 40 50 53 bb 07
    00 b4 0e cd 10 5b 58 c3 56 51 53 88 d3 80 e2 8f
    f6 c3 20 74 2d bb aa 55 b4 41 cd 13 72 24 81 fb
    55 aa 75 1e f6 c1 01 74 19 5b 59 66 6a 00 57 51
    06 53 6a 01 6a 10 89 e6 b8 00 42 cd 13 8d 64 10
    eb 45 5b 59 53 52 57 51 06 b4 08 cd 13 07 72 39
    51 c0 e9 06 86 e9 89 cf 59 c1 ea 08 92 40 83 e1
    3f f7 e1 96 58 5a 39 f2 73 23 f7 f6 39 f8 77 1d
    c0 e4 06 86 e0 92 f6 f1 fe c4 00 e2 89 d1 5a 5b
    86 f0 b8 01 02 cd 13 eb 09 59 5f eb 02 b4 40 5a
    5b f9 5e c3 00 00 00 00 00 00 00 00 00 00 00 00
    00 00 00 00 00 00 00 00 58 8c 58 8c 00 00 00 01
    01 00 bc ef 3f 26 3f 00 00 00 31 ff b9 03 80 00
    c1 ff 07 ef ff ff 70 ff b9 03 a0 e1 96 05 00 00
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
    Partition 1:
    ====================
    Is Bootable: false
    Begin Head: 1
    Begin Cylinder: 0
    Begin Sector: 1
    Partition Type: 0xbc
    End Head: 239
    End Cylinder: 38
    End Sector: 63
    Relative Sector: 63
    Num Sectors: 62521137
    Partition 2:
    ====================
    Is Bootable: true
    Begin Head: 0
    Begin Cylinder: 1023
    Begin Sector: 1
    Partition Type: 0x7
    End Head: 239
    End Cylinder: 1023
    End Sector: 63
    Relative Sector: 62521200
    Num Sectors: 93774240
    Partition 3:
    ====================
    Is Bootable: false
    Begin Head: 0
    Begin Cylinder: 0
    Begin Sector: 0
    Partition Type: 0x0
    End Head: 0
    End Cylinder: 0
    End Sector: 0
    Relative Sector: 0
    Num Sectors: 0
    Partition 4:
    ====================
    Is Bootable: false
    Begin Head: 0
    Begin Cylinder: 0
    Begin Sector: 0
    Partition Type: 0x0
    End Head: 0
    End Cylinder: 0
    End Sector: 0
    Relative Sector: 0
    Num Sectors: 0

    Created: C:\Documents and Settings\Administrator\My Documents\LiveView Images\data001.dd.vmx
    #Static Values
    config.version = "8"
    virtualHW.version = "3"
    floppy0.present = "FALSE"
    displayName="data001.dd"

    #Drive Info
    ide0:0.present = "TRUE"
    ide0:0.fileName = "C:\Documents and Settings\Administrator\My Documents\LiveView Images\data001.dd.vmdk"
    ide0:0.deviceType = "disk"
    ide0:0.mode = "persistent"
    ide1:0.present = "TRUE"
    ide1:0.fileName = "auto detect"
    ide1:0.deviceType = "cdrom-raw"

    #User Specified
    memsize="512"
    rtc.starttime="1291387172"
    tools.syncTime="FALSE"
    time.syncronized.continue="FALSE"
    time.syncronized.restore="FALSE"
    time.syncronized.resume.disk="FALSE"
    time.syncronized.resume.memory="FALSE"
    time.syncronized.shrink="FALSE"
    snapshot.disabled = "TRUE"

    Created: C:\Documents and Settings\Administrator\My Documents\LiveView Images\data001.dd.vmdk
    # Disk Descriptor File
    version=1
    CID=fffffffe
    parentCID=ffffffff
    createType="monolithicFlat"

    # Extent description
    RW 156295440 FLAT "G:\data001.dd" 0
    RW 6174 ZERO

    #DDB - Disk Data Base
    ddb.adapterType = "ide"
    ddb.geometry.sectors = "63"
    ddb.geometry.heads = "239"
    ddb.geometry.cylinders = "1023"
    ddb.virtualHWVersion = "3"

    Executing:
    Output: User Chose To Start From Scratch

    Output: Cleaned up old files

    Output: Generating vmx file…

    Output: Generating vmdk file…

    External Proc Output:
    External Process Error:
    Output: Snapshot Created

    Executing:
    External Proc Output:
    External Process Error:
    Output: Snapshot Mounted

    Executing:
    External Proc Output:
    Error: ep: Error:  The process cannot access the file because it is being used by another process.

    Exception: Software Hive Load Failed
    Error: Software Hive Load Failed
    Executing:
    Output: Cleaning up…

    External Proc Output:
    External Process Error:
    Executing:
    External Proc Output:
    Error: ep: Error:  The parameter is incorrect.

    Executing:
    External Proc Output:
    Error: ep: Error:  The parameter is incorrect.

    Error: Problem preparing partition2 for launch
    Output: VM Launch Failed

     
  • b0dhi911
    b0dhi911
    2010-12-03

    I should add, I'm using the following:

    LiveView version: 0.7b
    VMware Workstation 7.0.0 build-203739
    VMware Virutal Disk Development Kit  (VMware-vix-disklib-1.1.0-163495.i386.exe)
    VMware VCenter Converter  (VMware-converter-4.0.1-161434.exe)

    Running all this on Windows XP Professional SP3

     
  • b0dhi911
    b0dhi911
    2010-12-06

    no one reading these posts anymore? :)

    I've been further battling my problem.  I have tried launching the PDE with EnCase v6.17 as well.  The PDE adds the drive with no problems (looks like drive #1):

    C:\Documents and Settings\Administrator>wmic /namespace:\\root\cimv2 path Win32_
    DiskDrive get index, InterfaceType, model, size
    Index  InterfaceType  Model
             Size
    1      IDE            Virtual GSI Disk
             48010959360
    0      IDE            ST31500341AS
             1500299297280
    7      1394           Digital Intelligence  SATA Bridge Device 00 IEEE 1394 SBP2
    Device  250056737280
    8      1394           Digital Intelligence  SATA Bridge Device 00 IEEE 1394 SBP2
    Device  160039272960
    6      1394           Tableau Forensic SATA Bridge IEEE 1394 SBP2 Device
             0
    2      USB            Generic USB CF Reader USB Device

    3      USB            Generic USB MS Reader USB Device

    4      USB            Generic USB SD Reader USB Device

    5      USB            Generic USB xD/SM Reader USB Device

    MostRecentRun.log indicates this:
    ============================START============================
    External Proc Output: ! REG.EXE VERSION 3.0
    HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Virtual Disk Development Kit
        InstallPath REG_SZ C:\Program Files\VMware\VMware Virtual Disk Development Kit\

    External Process Error:
    Live View 0.7b
    Host Operating System: Windows XP
    Java Version: 1.6
    Executing:
    External Proc Output: ! REG.EXE VERSION 3.0
    HKEY_LOCAL_MACHINE\SOFTWARE\VMWare, Inc.
        Core REG_SZ VMware Workstation

    External Process Error:
    Executing:
    External Proc Output: ! REG.EXE VERSION 3.0
    HKEY_LOCAL_MACHINE\SOFTWARE\VMWare, Inc.\VMware Workstation
        ProductVersion REG_SZ 7.0.0.203739

    External Process Error:
    Executing:
    External Proc Output: ! REG.EXE VERSION 3.0
    HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Workstation
        InstallPath REG_SZ C:\Program Files\VMware\VMware Workstation\

    External Process Error:
    VMWare Install Type: 0
    VMWare Mount Path: C:\Program Files\VMware\VMware Virtual Disk Development Kit\bin\vmware-mount.exe
    Executing:
    External Proc Output:
    External Process Error: Error:  The system was unable to find the specified registry key or value

    Executing:
    External Proc Output: Index  InterfaceType 
    1      IDE           
    0      IDE           
    7      1394          
    8      1394          
    6      1394          
    2      USB           
    3      USB           
    4      USB           
    5      USB           

    External Process Error:
    Executing:
    External Proc Output: Index  Model                                                             
    1      Virtual GSI Disk                                                  
    0      ST31500341AS                                                      
    7      Digital Intelligence  SATA Bridge Device 00 IEEE 1394 SBP2 Device 
    8      Digital Intelligence  SATA Bridge Device 00 IEEE 1394 SBP2 Device 
    6      Tableau Forensic SATA Bridge IEEE 1394 SBP2 Device                
    2      Generic USB CF Reader USB Device                                  
    3      Generic USB MS Reader USB Device                                  
    4      Generic USB SD Reader USB Device                                  
    5      Generic USB xD/SM Reader USB Device                               

    External Process Error:
    Executing:
    External Proc Output: __PATH                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
    \\FRED\root\cimv2:Win32_LogicalDisk.DeviceID="C:"                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        
    \\FRED\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #2"  root\cimv2  FRED  {"CIM_DiskPartition", "CIM_StorageExtent", "CIM_LogicalDevice", "CIM_LogicalElement", "CIM_ManagedSystemElement"}  34  Win32_DiskPartition.DeviceID="Disk #0, Partition #2"  CIM_ManagedSystemElement  CIM_DiskPartition  Win32_DiskPartition  2      512  TRUE  TRUE  Disk #0, Partition #2      Win32_DiskPartition  Installable File System  Disk #0, Partition #2  0          2      Disk #0, Partition #2  2928151485        TRUE      1499213560320  1085736960      Win32_ComputerSystem  FRED  Installable File System 

    External Process Error:
    Bootable device is index: 0
    Executing:
    External Proc Output: Index  Size          
    1      48010959360   
    0      1500299297280 
    7      250056737280  
    8      160039272960  
    6      0             
    2                    
    3                    
    4                    
    5                    

    External Process Error:
    Device Index: 1
    Device Size: 48010959360
    Skipped \\.\PhysicalDrive1 detected with WMI because it has an invalid MBR
    Device Index: 0
    Device Size: 1500299297280
    Excluded Device Index: 0 because it is the host boot drive
    Device Index: 7
    Device Size: 250056737280
    Skipped \\.\PhysicalDrive7 detected with WMI because it has an invalid MBR
    Device Index: 8
    Device Size: 160039272960
    Skipped \\.\PhysicalDrive8 detected with WMI because it has an invalid MBR
    Device Index: 6
    Device Size: 0
    Skipped Device: 6 detected w/ WMI because a size of 0 was reported
    Device Index: 2
    Device Size:
    Skipped Device: 2 detected w/ WMI because no size was reported
    Device Index: 3
    Device Size:
    Skipped Device: 3 detected w/ WMI because no size was reported
    Device Index: 4
    Device Size:
    Skipped Device: 4 detected w/ WMI because no size was reported
    Device Index: 5
    Device Size:
    Skipped Device: 5 detected w/ WMI because no size was reported
    Error: Could not open physical device:  \\.\PhysicalDrive9 \\.\PhysicalDrive9 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive10 \\.\PhysicalDrive10 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive11 \\.\PhysicalDrive11 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive12 \\.\PhysicalDrive12 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive13 \\.\PhysicalDrive13 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive14 \\.\PhysicalDrive14 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive15 \\.\PhysicalDrive15 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive16 \\.\PhysicalDrive16 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive17 \\.\PhysicalDrive17 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive18 \\.\PhysicalDrive18 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive19 \\.\PhysicalDrive19 (The system cannot find the file specified)
    Executing:
    External Proc Output: Index  InterfaceType 
    1      IDE           
    0      IDE           
    7      1394          
    8      1394          
    6      1394          
    2      USB           
    3      USB           
    4      USB           
    5      USB           

    External Process Error:
    Executing:
    External Proc Output: Index  Model                                                             
    1      Virtual GSI Disk                                                  
    0      ST31500341AS                                                      
    7      Digital Intelligence  SATA Bridge Device 00 IEEE 1394 SBP2 Device 
    8      Digital Intelligence  SATA Bridge Device 00 IEEE 1394 SBP2 Device 
    6      Tableau Forensic SATA Bridge IEEE 1394 SBP2 Device                
    2      Generic USB CF Reader USB Device                                  
    3      Generic USB MS Reader USB Device                                  
    4      Generic USB SD Reader USB Device                                  
    5      Generic USB xD/SM Reader USB Device                               

    External Process Error:
    Executing:
    External Proc Output: __PATH                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
    \\FRED\root\cimv2:Win32_LogicalDisk.DeviceID="C:"                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        
    \\FRED\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #2"  root\cimv2  FRED  {"CIM_DiskPartition", "CIM_StorageExtent", "CIM_LogicalDevice", "CIM_LogicalElement", "CIM_ManagedSystemElement"}  34  Win32_DiskPartition.DeviceID="Disk #0, Partition #2"  CIM_ManagedSystemElement  CIM_DiskPartition  Win32_DiskPartition  2      512  TRUE  TRUE  Disk #0, Partition #2      Win32_DiskPartition  Installable File System  Disk #0, Partition #2  0          2      Disk #0, Partition #2  2928151485        TRUE      1499213560320  1085736960      Win32_ComputerSystem  FRED  Installable File System 

    External Process Error:
    Bootable device is index: 0
    Executing:
    External Proc Output: Index  Size          
    1      48010959360   
    0      1500299297280 
    7      250056737280  
    8      160039272960  
    6      0             
    2                    
    3                    
    4                    
    5                    

    External Process Error:
    Device Index: 1
    Device Size: 48010959360
    Skipped \\.\PhysicalDrive1 detected with WMI because it has an invalid MBR
    Device Index: 0
    Device Size: 1500299297280
    Excluded Device Index: 0 because it is the host boot drive
    Device Index: 7
    Device Size: 250056737280
    Skipped \\.\PhysicalDrive7 detected with WMI because it has an invalid MBR
    Device Index: 8
    Device Size: 160039272960
    Skipped \\.\PhysicalDrive8 detected with WMI because it has an invalid MBR
    Device Index: 6
    Device Size: 0
    Skipped Device: 6 detected w/ WMI because a size of 0 was reported
    Device Index: 2
    Device Size:
    Skipped Device: 2 detected w/ WMI because no size was reported
    Device Index: 3
    Device Size:
    Skipped Device: 3 detected w/ WMI because no size was reported
    Device Index: 4
    Device Size:
    Skipped Device: 4 detected w/ WMI because no size was reported
    Device Index: 5
    Device Size:
    Skipped Device: 5 detected w/ WMI because no size was reported
    Error: Could not open physical device:  \\.\PhysicalDrive9 \\.\PhysicalDrive9 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive10 \\.\PhysicalDrive10 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive11 \\.\PhysicalDrive11 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive12 \\.\PhysicalDrive12 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive13 \\.\PhysicalDrive13 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive14 \\.\PhysicalDrive14 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive15 \\.\PhysicalDrive15 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive16 \\.\PhysicalDrive16 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive17 \\.\PhysicalDrive17 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive18 \\.\PhysicalDrive18 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive19 \\.\PhysicalDrive19 (The system cannot find the file specified)
    Executing:
    External Proc Output: Index  InterfaceType 
    1      IDE           
    0      IDE           
    7      1394          
    8      1394          
    6      1394          
    2      USB           
    3      USB           
    4      USB           
    5      USB           

    External Process Error:
    Executing:
    External Proc Output: Index  Model                                                             
    1      Virtual GSI Disk                                                  
    0      ST31500341AS                                                      
    7      Digital Intelligence  SATA Bridge Device 00 IEEE 1394 SBP2 Device 
    8      Digital Intelligence  SATA Bridge Device 00 IEEE 1394 SBP2 Device 
    6      Tableau Forensic SATA Bridge IEEE 1394 SBP2 Device                
    2      Generic USB CF Reader USB Device                                  
    3      Generic USB MS Reader USB Device                                  
    4      Generic USB SD Reader USB Device                                  
    5      Generic USB xD/SM Reader USB Device                               

    External Process Error:
    Executing:
    External Proc Output: __PATH                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
    \\FRED\root\cimv2:Win32_LogicalDisk.DeviceID="C:"                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        
    \\FRED\root\cimv2:Win32_DiskPartition.DeviceID="Disk #0, Partition #2"  root\cimv2  FRED  {"CIM_DiskPartition", "CIM_StorageExtent", "CIM_LogicalDevice", "CIM_LogicalElement", "CIM_ManagedSystemElement"}  34  Win32_DiskPartition.DeviceID="Disk #0, Partition #2"  CIM_ManagedSystemElement  CIM_DiskPartition  Win32_DiskPartition  2      512  TRUE  TRUE  Disk #0, Partition #2      Win32_DiskPartition  Installable File System  Disk #0, Partition #2  0          2      Disk #0, Partition #2  2928151485        TRUE      1499213560320  1085736960      Win32_ComputerSystem  FRED  Installable File System 

    External Process Error:
    Bootable device is index: 0
    Executing:
    External Proc Output: Index  Size          
    1      48010959360   
    0      1500299297280 
    7      250056737280  
    8      160039272960  
    6      0             
    2                    
    3                    
    4                    
    5                    

    External Process Error:
    Device Index: 1
    Device Size: 48010959360
    Skipped \\.\PhysicalDrive1 detected with WMI because it has an invalid MBR
    Device Index: 0
    Device Size: 1500299297280
    Excluded Device Index: 0 because it is the host boot drive
    Device Index: 7
    Device Size: 250056737280
    Skipped \\.\PhysicalDrive7 detected with WMI because it has an invalid MBR
    Device Index: 8
    Device Size: 160039272960
    Skipped \\.\PhysicalDrive8 detected with WMI because it has an invalid MBR
    Device Index: 6
    Device Size: 0
    Skipped Device: 6 detected w/ WMI because a size of 0 was reported
    Device Index: 2
    Device Size:
    Skipped Device: 2 detected w/ WMI because no size was reported
    Device Index: 3
    Device Size:
    Skipped Device: 3 detected w/ WMI because no size was reported
    Device Index: 4
    Device Size:
    Skipped Device: 4 detected w/ WMI because no size was reported
    Device Index: 5
    Device Size:
    Skipped Device: 5 detected w/ WMI because no size was reported
    Error: Could not open physical device:  \\.\PhysicalDrive9 \\.\PhysicalDrive9 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive10 \\.\PhysicalDrive10 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive11 \\.\PhysicalDrive11 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive12 \\.\PhysicalDrive12 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive13 \\.\PhysicalDrive13 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive14 \\.\PhysicalDrive14 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive15 \\.\PhysicalDrive15 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive16 \\.\PhysicalDrive16 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive17 \\.\PhysicalDrive17 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive18 \\.\PhysicalDrive18 (The system cannot find the file specified)
    Error: Could not open physical device:  \\.\PhysicalDrive19 \\.\PhysicalDrive19 (The system cannot find the file specified)

    Not having any luck with either the DD image file or the PDE…  need some advice… any ideas folks?

    Thanks.

     
  • 4n6 man
    4n6 man
    2010-12-06

    can you view the filesystem with any other tool?  For example, when you mount the image with PDE can browse in encase?  In your last error log liveview seems to skip physicaldrive1 due to an invalid mbr, though in your first post the mbr seems to be recognized ok.

    what is on the first partition?

     
  • b0dhi911
    b0dhi911
    2010-12-06

    There is a Linux partition on the 1st partition.  It's a small linux partition that our corporate desktop team uses to help them quickly re-image the Windows XP partition.  What happens in this case is that Linux partition boots and it runs some scripts, then reboots itself and loads the Windows XP partition..

    The 2nd attempt I thought I would try to bust out the Windows XP partition by mounting it as a PDE in EnCase, since I couldn't get the Linux boot partition to work by dd'ing the whole physical disk.   I thought I read somewhere that it was possible to do this with LiveView (where LV would create the missing MBR and boot the bootable partition)…  That's what I was trying to do in the 2nd case…

    When I mount the drive using PDE, I can view the files no problem. The drive shows up under a proper drive letter…

     
  • b0dhi911
    b0dhi911
    2010-12-06

    I should add that when I try to select Linux as the operating system (instead of auto-detect), LiveView generates the Snapshot etc. no problems, but when the vm runs, I get "Kernel Panic - not syncing: VFS: unable to mount root fs on unknown-block(8,1)