Live View version 0.7b is a Java-based graphical forensics tool that creates a VMware virtual machine out of a raw (dd-style) disk image or physical disk. This allows the forensic examiner to “boot up” the image or disk and gain an interactive, user-level perspective of the environment, all without modifying the underlying image or disk. Because all changes made to the disk are written to a separate file, the examiner can instantly revert all changes back to the original, pristine state of the disk. The end result is that “throw away” copies of the disk or image do not need to be created to create the virtual machine.
Live View is also available in the LE (law enforcement) version, which offers features to investigators that are not available in the public version.
Behind the scenes, Live View automates a wide array of technical tasks, including resolving hardware conflicts resulting from booting on hardware other than that on which the OS was originally installed, creating a customized master boot record (MBR) for partition-only images, and correctly specifying a virtual disk to match the original image or physical disk.
