This incidents.org article the other day caught my eye. It talked of a utility calledliveview that could take a hard drive (or image of a drive) and make it into a virtual machine for use in vmware (saving all changes to a temporary file so the original structure of the disk/drive image is not touched.) It looks like you need to have Windows as your base platform, but it looks as though it would be a useful tool. Windows Incident Response possibly saw the same note on Incidents.org.