Tuesday, 7 October 2008

Transition to XP 64

We upgrade our forensic workstations every eighteen months or so have just taken delivery of four shiny new ones. This time I decided that the time had come for us to enter the brave new world of 64 bit operating systems. I have read many peoples experiences of this on Digital Detective, Forensic Focus and so on and was expecting a number of difficulties. However the driver for change is utilising 8gb ram so XP 64 bit was specified. To be on the safe side I had the machines built in a dual boot configuration with XP 64 bit on one partition and XP 32 bit on another. As an additional safeguard on the 64 bit side I installed VMWare Workstation and created an XP 32 bit VM.

So if it helps anyone here is a list of what works (and what doesn't).

XP 64 Software installations

64 bit programs

Encase 6.11.2 x64
Encase installed OK. Help About shows that the PDE, VFS, EFS and Fastbloc SE modules are installed and I have successfully tested PDE.

Tomtology x64 1.162, .NET 3.5 Redistributable and the keylock dongle drivers all installed and working.




CodeMeter Runtime 3.30a is needed for the FTK codemeter dongle.

Gimp 2.5.4

32 bit programs that work within the 64 bit OS

Encase 6.11.2 32 bit version
The 32 bit version installs and runs OK.

Access Data FTK
I had hoped to upgrade to FTK2 but a 64 bit version has not been released. I did however decide to transfer our licences from the green keylock dongle to the Codemeter dongle. There are detailed instructions on how to do this within the FTK2 box. I used an internet connected laptop with the latest version of Licence Manager installed to carry out the transfer. Once the licences were on the codemeter dongle I installed CodeMeter Runtime 3.30a (64 bit) onto the XP 64 bit box and then inserted the dongle. It was successfully recognized. FTK 1.81 and Registry Viewer 1.5.3 have been installed and they work OK.

Microsoft Office 2007
The office programs are 32 bit but are designed to work with a 64 bit MS OS.

I have installed VFC, the green keylock dongle drivers and VMWare Diskmount Utility. All seem to work OK.

C4P v3.3.4 runs without issue. However some work is needed to get the C4P graphics extractor enscript running.

For Encase v6 64 bit running on XP 64 bit install the 64 bit MySQL 3.51 ODBC connector driver found at http://dev.mysql.com/downloads/connector/odbc/3.51.html#winx64
and also a MS hotfix found at http://www.microsoft.com/downloads/details.aspx?FamilyID=000364db-5e8b-44a8-b9be-ca44d18b059b&displaylang=en

The latest C4P v4 graphics extractor enscript contains a mySQL database connection string which needs modification (if you are using mysql). The string needs to be edited to read:

Conn.Open("PROVIDER=MSDASQL;DRIVER={MySQL ODBC 3.51 Driver};SERVER=" + Com.serverName + ";DATABASE=" + DbName + ";" + "UID=c4p_user;PASSWORD=password;OPTION=3")

NetAnalysis 1.38 beta 6 is running OK

Irfanview 4.20 is a running OK

Saminside v2.5.7.1 is running OK

Isobuster 1.9 Pro
Isobuster 1.9 Pro works OK

Various other utilities such as PSPad, FileAlyzer, WRR and WFA are also working OK.

Things that did not work

Well not much really. The Microsoft powertoy picture resizer does not work but is adequately replaced with http://adionsoft.net/fastimageresize/


Hex said...

Only just come across your helpful post months later... I decided to play with fire and loaded up Vista x64 onto a new forensic box.

So far I've had pretty similar results but can't get VMware Diskmount (the 5.5 version) to install, so LiveView won't install at all.

Is this a problem with XP x64 as well?

Also the current release of the .XRY mobile phone examination software doesn't seem to work on XP or Vista x64, so we've had to run it in a 32-bit VM.

DC1743 said...

I had not attempted to installed Liveview until I saw this comment (I have installed VFC). So far I have failed to install it because the installer does not seem to detect the previously installed 64 bit Java RE.

Emee said...
This comment has been removed by the author.
Emee said...

Great post, just stumbled upon it during our upgrades.
Just a note, the latest version of the 64 bit MySQL ODBC connector driver is 5.1 and as such one needs to rename that in the c4p enscript.

No issues with vmware mount (for VFC) using VMware-mount-5.5.0-18463. Working perfectly

DC1743 said...


The enscript can be modified to use the newer driver, however I found it to be noticeably slower.

Also if you use the data migration/special option in C4P itself you cannot modify the database connection string because it is hard coded into the program. Having said that to get this feature working in XP64 you will have to install the 32 bit driver alongside the 64 bit one.