The following resources were valuable in the creation of Live View:

• Carrier, Brian. File System Forensic Analysis. ISBN: 0-32-126817-2. Addison Wesley, 2005.

• Hankeln, Ulli. "VMX-File Parameters." Sanbarrow. <http://sanbarrow.com/vmx.html>.

• "NSIS Reference." Nullsoft. <http://www.nullsoft.com/free/nsis/makensis.htm>.

• Penhallurick, Michael A. Methodologies for the Use of VMware to Boot Cloned/Mounted Subject Hard Disk Images. Diss. Cranfield Univ., 2005. <http://www.e5hforensics.com/Downloads/VMware%20Forensic%20Cloning%20Methodology.pdf>.

• "Preventing INACCESSIBLE_BOOT_DEVICE." Charles University. <http://artax.karlin.mff.cuni.cz/~nozkj1am/ostatni/windows/BOOT.html>.

• Sedory, Daniel B. "An Examination of the Standard MBR." 17 Aug. 2004. <http://mirror.href.com/thestarman/asm/mbr/STDMBR.htm>.

• Timekeeping in VMware Virtual Machines. <http://www.vmware.com/pdf/vmware_timekeeping.pdf>.

• VMware DiskMount Utility: User's Manual. <http://www.vmware.com/pdf/VMwareDiskMount.pdf>.

• "VMware Workstation 5.5: Command Line Application." VMware. <http://www.vmware.com/support/ws55/doc/ws_learning_cli_vmrun.html>.

• "Week 4 - Using Linux VMware Workstation and Raw Disk Images to View the Suspect Workstation." Linux Forensics Weekly (2004). <http://www.agilerm.net/linux4.html>.

• "You Receive a Stop 0x0000007B Error After You Move the Windows XP System Disk to Another Computer." Microsoft Knowledge Base. 3 Feb. 2005. <http://support.microsoft.com/kb/314082>.

Special thanks to Matthew Geiger and the CERT PDT forensics team for their valuable help and input.