How to pwn (P2V) a LIVE Windows server and reconstruct (V2P) Cheaply - Part I
If you’ve been reading our recent articles about virtualization, we’ve described some fabulous stuff you can do with VMWare and Parallels. Now we’ll outline a very specific set of tricks used recently to virtualize a LIVE PRODUCTION Windows server on a low to near zero budget, without shutting it down(!). This is just one way to deal with this issue, there are many pathways!
This process is commonly referred to as P2V in the virtualization world, and specialized tools for the conversion process often run into the thousands of dollars.
BASELINE CONSTRAINTS
- We cannot shut down the SOURCE Windows server for the P2V process
- The resulting P2V data will be used for development purposes initially
- Data can be re-synced from SOURCE separately at a later date
- The server is off-site, behind a slow VPN, so HOT virtualization via direct link is not happening
- We have Administrator rights on the source server
- We have adequate storage on the source server to hold the compressed snapshot images - typical compression is 2:1
- We have a local Windows instance equal to, or higher than that of the SOURCE server to re-construct images and correct boot information while rebuilding
- Our source server for this example P2V has two volumes, C (4gb), D (30gb)
TOOLSET
- Drivesnapshot - drivesnapshot.de - $50
- Boot Corrector - bootcorrector.us - $20
- VMWare Converter - Link
- External Firewire or USB 2.0 Hard Drive with 3x storage of compressed snapshot source drives
- Local Windows VM instance (We’ll call it VM Workbench) matching or higher version than SOURCE OS to build the final drive images
PROCESS
- Download/Purchase all necessary tools
- Install drivesnapshot on SOURCE machine
- Run drivesnapshot, creating image files for each SOURCE partition (you can exclude Compaq/Dell hidden system partitions)
- Transfer drive images to Virtualization Server
- Launch VM Workbench
- Create two vmdk volumes which are at least as large as the volumes you have captured from the source server
- Add the newly created volumes to your VM Workbench instance
- Install or transfer Drivesnapshot in the VM Workbench instance
- Move, or mount the volume which which holds the snapshots of your server
- Run drivesnapshot, direct it to the location of your server C image, and target the blank C vmdk disk you created for a restore. Do the same for the D image and vmdk
- You should now have a complete replica of all files from the source server, next, we’ll make these bootable and actually run!
To be continued in part two…