"Failed to Load Partitions for Device" "The partition table is invalid"

[JozefM]

I didn't find the answer at the forum to similar questions, so, excuse me if the question is duplicite.

I would like to boot the image (created in FTK Imager, as "name.001") of 60 GB hard disc with Windows 10 OS, within Windows 7 host PC.

I've tried several combinations in the Settings, but the result (an error) is the same.

1) Is it possible to control partitions of the disc image (created and mounted by FTK Imager) within the host PC Computer Management? If yes - I don´t see the image as a disc.

2) After selecting a physical disk as a device for the virtual machine, returns the error ("Failed to Load Partitions for Device" "The partition table is invalid").

If somebody has time for help, I would like to ask for an advice.

Thank you.

[continuum]

If I remember right FTK-imager creates a proprietory disk format which is not comparable with a dd image,
If I remember wrong and FTK imager creates a dd-compatible disk image the procedure to use it with a VM is simple.

Assuming your image file is named name.001 and has a filesize of X bytes then create a textfile with the following content:

# Disk DescriptorFile

version=1

CID=fffffffe

parentCID=ffffffff

createType="monolithicFlat"

  # Extent description

RW Y FLAT "name.001" 0

Replace Y with the result of X/512 which should be an integer.

Store the textfile as name.vmdk in the same directory where you also have name.001
Then create new VM and assign an existing vmdk - do NOT use a physical disk.
During first boot Workstation will ask you wether you want to update the diskformat.

You can say YES as this will only modify the textdescriptor name.vmdk.

If you want to do a forensic investigation of this image you want to create a snapshot BEFORE you boot the first time - as this will effectively set the name.001 file to read-only mode.

Ulli

[continuum]

By the way - very likely a VM with this VMDK will not be able to boot - as the hardware differs too much.

This should not matter as you will use a LiveCD to boot from if you are doing forensic analysis.

If you dont plan to analyse the image but use the image for P2V run VMware Converter "configure image" against the newly created vmx-file.

[JozefM]

Thank you Ulli.

I've created new vmdk file according to your template, but in wizzard after selecting an existing disk it returns: "The file specified is not a virtual disk".

Here is an example of the content of other vmdk files:

# Disk DescriptorFile
version=1
encoding="windows-1250"
CID=fffffffe
parentCID=ffffffff
isNativeSnapshot="no"
createType="fullDevice"

# Extent description
RW 117118952 FLAT "\\.\PhysicalDrive2" 0

# The Disk Data Base
#DDB

ddb.adapterType = "lsilogic"
ddb.geometry.biosCylinders = "1829983"
ddb.geometry.biosHeads = "2"
ddb.geometry.biosSectors = "32"
ddb.geometry.cylinders = "1829983"
ddb.geometry.heads = "2"
ddb.geometry.sectors = "32"
ddb.longContentID = "79cc266b55cc5414e225f488fffffffe"
ddb.uuid = "60 00 C2 9e 64 bf 3b a3-0c 69 73 c5 dd 2a 88 48"
ddb.virtualHWVersion = "12"

...Now I'm trying to use converter, but it returns:

"A file I/O error occured while accessing", or "Status: Failed: unable to find system volume, reconfiguration is not possible."

[continuum]

Can you show the first sector of your ftk-image in a hexdump ?

Then we can see if that image can be used.

[JozefM]

I can see the hex in HxD, but can not recognize where is the sector ends. Look in attachment please. Thanks.

[continuum · Accepted solution]

Now it makes sense ....

The image you have is a partition-image - not a disk image.

Partition images of NTFS start with ëRNTFS
The message "The partition table is invalid" appears because there is no partitiontable at all.
Your options are:

1. create a new image - this time tell FTK-imager to create an image of the disk - not just of a single partition.

2. inject one MB of zeroes at the start of that image. Then create descriptorfile as explained before.

On first boot of the VM use a Linux LiveCD and create a new partitiontable.

3. create new empty disk - make sure it is at least 9 MBs larger than your image file.

Boot with Linux LiveCD, create empty partitiontable. Then inject your complete image with dd like this

dd if=name.001 bs=1M seek=1 of=/dev/sda conv=notrunc

Second and third option are a bit advanced - but the only options if you can not create a new image.

[JozefM]

Thank you Ulli, the 1st option seems to be working.

Thanks for you willingness.