Using Qubes for forensic/Data extraction of a raw image that should stay RO

50 views

Skip to first unread message

Thierry Laurion

unread,

Mar 27, 2018, 11:32:55 AM3/27/18

to qubes-users

Hello all,

I've been extracting raw disk data from a 1TB from ddrescue for the past week. The last pass is showing a lot of errors, which means that I will have to repair the data before extracting it elsewhere, and i'm lacking space.

What I want to do is use Qubes to use that disk as a Standalone template, and save the changes elsewhere for the created VM, limiting the sizes of COW for only the reperations that will occur.

How would I accomplish that? The extracted file disk image is on another disk, mounted in sys-usb. Would it be possible to boot that disk an a newly created AppVM using that disk image? How would I do that?

Thanks a bunch! Thierry

Note: also posted here: https://www.reddit.com/r/Qubes/comments/87jbfm/using_qubes_for_forensicdata_extraction_of_a_raw/

Reply all

Reply to author

Forward

0 new messages