Log in

View Full Version : Acronis VMware interaction


naides
May 14th, 2008, 06:17
I have been playing around with these toys and I think it may have potential in malware reversing and other deep system troubleshooting. I would like to hear some comments/experiences.

Bottom line: It is possible to rip your current computer live system AS IS using Acronis true image backup, then mount the backup as a Virtual machine inside VMware, where you have far more control over things.

I think it has possibilities in certain situations, despite being a little cumbersome and time consuming.

owl
May 14th, 2008, 08:25
That sounds interesting, let me know if you try it and how it works.

dELTA
May 14th, 2008, 12:30
I assume that all the hardware in the computer will still be exchanged during this operation from the system's viewpoint, since VMware has its static setup of virtualized hardware and nothing else (which of course is for a good reason, since automatically virtualizing arbitrary hardware would be practically impossible)?

This will make hardware key based protections fail after the "move" (e.g. Windows activation), and will also be easily detectable by other applications (not that so many applications other than hardware-bounds licensing schemes would have any interest in this, but anyway ).

But sure, for malware analysis I'm sure it can come in very handy if you are presented with an infected machine that you want to analyze.

(until the malware starts using hardware based activation, or even VMware detection :devil

Iwarez
May 14th, 2008, 13:58
VMWare converter can also be used to convert a live system to a vmware harddisk image. I can confirm that it works.

TiGa
May 14th, 2008, 17:13
I used to do something similar with Virtual PC a long time ago.

Creating a differential virtual HD mirrored from the real one.
It did not require to make a backup but it doesn't work anymore on my latest computer.

TiGa