Virtual Forensic Computing (VFC): Boot mounted EnCase images

VFC Quick Start Guide

To use VFC:-

Download Mount Image Pro here. Mount the forensic image file using Mount Image Pro.

Download VFC from this page. Install and run VFC.

1. Select the mounted physical disk from the VFC drop down menu (if VFC is already running, you may need to use the Refresh button to ensure all mounted drives are visible to the VFC application)

2. Select the boot partition

3. Adjust the OS, RAM and date / time (if required) [these values are auto-populated by VFC and can be left alone]

4. Specify a name for the virtual machine (default is New Virtual Machine) and specify a name for the virtual disk cache (default is New Virtual Disk)

5. Generate the Virtual Machine and use the Launch button to use the requisite VMware application (alternatively the VMware application can be loaded separately and the Virtual Machine can be launched manually)

VMware Forensics

6.Once booted you will be able to operate the imaged computer as a user in a VMware forensic session.

VMware Forensics


Download VFC

Download VFC

EnCase is the registered trademark of Guidance Software Inc.
VMware is the registered trademark of VMware Inc.
VFC is the registered trademark of MD5 Ltd.