sudo is telling me I'm not allowed to do something. How do I get sudo to work? You may need to edit the list of users allowed to acquire super user privileges. See this page for a detailed description of how to add yourself to this list.

I can't get my virtual folder to mount in VirtualBox. Make sure that you've created a dummy folder on the guest, and that you're giving the virtual box folder name, followed by the dummy folder name. You should NOT be entering a path that has anything to do with the host OS.

fdisk, sfdisk, mount, or some other tool cannot be found but I think it's installed. Use "sudo fdisk" instead. If you don't have the privileges, Debian will act just like the tool is not installed.

Can I get an example of how to convert a VDI file to a RAW file using VBoxManage? Sure! VBoxManage clonehd diskImage.vdi -format raw diskImage.raw will convert diskImage.vdi to raw format and store this in diskImage.raw. Make sure you have 4 gigabytes of space free. Also, make sure you're calling VBoxManage from your host OS (i.e. NOT Debian).

I made a backup copy of a VDI and VirtualBox is complaining about files with duplicate UUIDs. VirtualBox doesn't like the idea of there being multiple VDI files with the same unique identifier (UUID), and it's really good at catching you at this. You can change the UUID with the sethduuid command. As an example: VBoxManage internalcommands sethduuid diskCopy.vdi. This won't affect the file in any way that will affect your forensic analysis.

When I try to mount a partition from a raw image of a drive using the built in mount command, it's giving me a very vague error that ends with "try dmesg | tail" for more info. Use "dmesg | tail" for more info.

When I try dmesg | tail, I get recovery required on readonly filesystem and write access unavailable, cannot proceed. It's ok to mount the drive with write privileges for recovery purposes. As soon as the drive is successfully mounted, we recommend that you umount the drive (using sudo umount) and then remount again in a read only fashion. Make sure to note that you've altered the raw image when answering the questions in your report.