Mounting VMDK files in Linux

06Jan13

Hello everyone!

Well it’s been a while since I’ve posted and I apologize for that.  I do have some ideas for posts “in the hopper” but I haven’t had a chance to sit down and really work on them.  I’m hoping with some “life changes” coming up this year I’ll have the opportunity to write more.  But we’ll see.

Anyway, I was looking for an easy way to mount VMDK files on my Linux box so I could do forensic analysis on the images.  Similar to how I’ve done things in the past with E01 files.  I didn’t really want to image the VM and then analyze it, since most of the time I’m using VM’s for testing.

So this will be short and sweet, but first a couple of caveats:

1) I have not tested this against split VMDK files yet, but I’m thinking it should work.

2) I haven’t even considered testing this against VM snapshot images, but I’m guessing that will not work.

3) You need to have AFFLIB installed and working

That being said, this post was inspired by Sketchymoose’s post

She talks about downloading the Virtual Disk Development kit, but one item in the post caught my eye:

“I first discovered I had to add the ‘-i aff’ parameter to get mmls to determine the disk structure of the vmdk file.”

I thought hey, there’s affuse!

Step 1:

affuse <vmdk file> /mount/point

ex: affuse windows7.vmdk /mnt/aff

Step 2:

mmls -t dos <mount point>/<vmdk file name>.raw

ex: mmls -t dos /mnt/aff/windows7.vmdk.raw

Step 3:

mount -o ro,loop,show_sys_files,streams_interface=windows,offset=<offset> <mount point>/<vmdk file>.raw /mount/point

ex: mount -o ro,loop,show_sys_files,streams_interface=windows,offset=1048576 /mnt/aff/windows7.vmdk.raw /mnt/windows

And voila!  /mnt/windows now contains the file structure of the VMDK image!

I’m sure someone else figured this out, but a google search didn’t come up with anything when I added AFF to the search query (for me at least).  So I thought I would share…

Also, keep in mind you can still use the -i AFF with TSK and VMDK images if you don’t need to mount it…

About these ads


18 Responses to “Mounting VMDK files in Linux”

  1. Well done and easy to follow. Thanks for sharing! Looking very forward to trying it out!

  2. Make your life easy and use Windows!

  3. Ehem…

    guestmount(1)

    • Or rather, vdfuse(1).

      guestmount(1) mounts the filesystems, vdfuse(1) exposes the whole device and any partitions in it much like device nodes in /dev, but as regular files instead of block devices.

  4. Oooh, hadn’t heard of guestmount before….I’ll have to check it out. Thanks for the info!

  5. Hmm is anyone else having problems with the images on
    this blog loading? I’m trying to determine if its a problem on my end or if it’s the blog.
    Any feedback would be greatly appreciated.

  6. 8 FL1SK

    Just use vmware-mount its much much easier ;-)

  7. 9 Drask

    Thanks a bunch, I never knew this could be done. Many is the time I wished I could pull some files out of a VM image.

    You might want to mention that you need to multiply the start point returned by mmls by the sector size when passing the offset to mount. For instance:

    DOS Partition Table
    Offset Sector: 0
    Units are in 512-byte sectors

    Slot Start End Length Description
    00: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
    01: —– 0000000000 0000000055 0000000056 Unallocated
    02: 00:00 0000000056 0083886079 0083886024 NTFS (0×07)

    To mount the NTFS partition, the line would need to be:

    mount -t ntfs -o ro,loop,show_sys_files,streams_interface=windows,offset=28672 /.raw

    since 28672 is 56*512.

  8. 10 ricci

    I tries the above with split vmdk files. Though affuse seems to be working, and mmls also shows the partition, but when I mount using the same command set, it cannot mount the win 7 partition.

    After using vdisk manager tool to combine them to one disk image, then it works.

    So seems that the vmdk file has to be combined. Any other method I can view the disk and extract content from it without combining the disk?4

  9. Works great here, I’ll be adding this to the forensic curriculum I instruct. Kudos to your diligent and alert work.

  10. 13 galusha1

    I am following this and am able to mount various vmdk’s from a virtual machine, but am having issues with one of the vmdk’s.

    Here is the output of the mmls command

    DOS Partition Table
    Offset Sector: 0
    Units are in 512-byte sectors

    Slot Start End Length Description
    00: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
    01: —– 0000000000 0000000062 0000000063 Unallocated
    02: 00:00 0000000063 0000002047 0000001985 Win LVM / Secure FS (0×42)
    03: 00:01 0000002048 0125827071 0125825024 Win LVM / Secure FS (0×42)

    I have a few ideas of what may have happened. One is we had one vmdk and then added a second and spanned the drives. Two we had one vmdk and made it larger and then used gparted to expand the drive. We have lost a months worth of data unless we can mount this. Please let me know. Thanks.

    • glausha1,
      You don’t mention what the error your getting is.

      CdtDelta

      • 15 galusha1

        Error –

        root@xss03-vsrv-lnxtst:/mnt/sql-E# mount -t ntfs -o ro,loop,show_sys_files,streams_interface=windows,offset=32256 /mnt/sql1/DECY01-VSRV-SQL1-flat.vmdk.raw /mnt/decy-vsrv-sql/
        NTFS signature is missing.
        Failed to mount ‘/dev/loop2′: Invalid argument
        The device ‘/dev/loop2′ doesn’t seem to have a valid NTFS.
        Maybe the wrong device is used? Or the whole disk instead of a
        partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

      • Ok so normally when I get that error it’s because the partition offset is wrong.

        mmls is showing two partitions with this image, what happens when you use the offset for the second partition?

        So offset=1048576 instead of offset=32256?

  11. 17 galusha1

    Basically same error. I think the key is that in the command I am running its trying to mount it as ntfs, but the partition is not ntfs, its LVM (logical volume). To me that means spanned volume across multiple partitions meaning we have to first combined them and then mount them as ntfs.

    –Here is the output of that command–

    root@xss03-vsrv-lnxtst:/home/service# mount -t ntfs -o ro,loop,show_sys_files,streams_interface=windows,offset=1048576 /mnt/sql1/DECY01-VSRV-SQL1-flat.vmdk.raw /mnt/decy-vsrv-sql/
    Failed to read last sector (125825023): Invalid argument
    HINTS: Either the volume is a RAID/LDM but it wasn’t setup yet,
    or it was not setup correctly (e.g. by not using mdadm –build …),
    or a wrong device is tried to be mounted,
    or the partition table is corrupt (partition is smaller than NTFS),
    or the NTFS boot sector is corrupt (NTFS size is not valid).
    Failed to mount ‘/dev/loop0′: Invalid argument
    The device ‘/dev/loop0′ doesn’t seem to have a valid NTFS.
    Maybe the wrong device is used? Or the whole disk instead of a
    partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

    –Here is the contents of the VM Folder–

    root@xss03-vsrv-lnxtst:/mnt/sql-E# la -la /mnt/temp/DECY01-VSRV-SQL1/
    total 114755505
    drwxrwxrwx 2 1024 users 0 Apr 13 2001 .
    drwxrwxrwx 11 root root 0 Apr 12 2001 ..
    -rwxrwxrwx 1 1024 users 42949672960 Apr 12 2001 DECY01-VSRV-SQL1_1-flat.vmdk
    -rwxrwxrwx 1 1024 users 505 Apr 12 2001 DECY01-VSRV-SQL1_1.vmdk
    -rwxrwxrwx 1 1024 users 21474836480 Apr 12 2001 DECY01-VSRV-SQL1_2-flat.vmdk
    -rwxrwxrwx 1 1024 users 479 Apr 12 2001 DECY01-VSRV-SQL1_2.vmdk
    -rwxrwxrwx 1 1024 users 8589934592 Apr 12 2001 DECY01-VSRV-SQL1-7aa7efce.vswp
    -rwxrwxrwx 1 1024 users 13 Apr 12 2001 DECY01-VSRV-SQL1-aux.xml
    -rwxrwxrwx 1 1024 users 249298944 Apr 12 2001 DECY01-VSRV-SQL1-flat.vmdk
    -rwxrwxrwx 1 1024 users 8684 Apr 12 2001 DECY01-VSRV-SQL1.nvram
    -rwxrwxrwx 1 1024 users 504 Apr 12 2001 DECY01-VSRV-SQL1.vmdk
    -rwxrwxrwx 1 1024 users 0 Apr 12 2001 DECY01-VSRV-SQL1.vmsd
    -rwxrwxrwx 1 1024 users 3963 Apr 12 2001 DECY01-VSRV-SQL1.vmx
    -rwxrwxrwx 1 1024 users 3964 Apr 12 2001 DECY01-VSRV-SQL1.vmx~
    -rwxrwxrwx 1 1024 users 271 Apr 12 2001 DECY01-VSRV-SQL1.vmxf
    -rwxrwxrwx 1 1024 users 44023414784 Apr 12 2001 DECY01-VSRV-SQL-flat.vmdk
    -rwxrwxrwx 1 1024 users 476 Apr 12 2001 DECY01-VSRV-SQL.vmdk
    -rwxrwxrwx 1 1024 users 3104176 Apr 12 2001 vmware-36.log
    -rwxrwxrwx 1 1024 users 423493 Apr 12 2001 vmware-37.log
    -rwxrwxrwx 1 1024 users 329220 Apr 12 2001 vmware-38.log
    -rwxrwxrwx 1 1024 users 290300 Apr 12 2001 vmware-39.log
    -rwxrwxrwx 1 1024 users 605006 Apr 12 2001 vmware-40.log
    -rwxrwxrwx 1 1024 users 468879 Apr 12 2001 vmware-41.log
    -rwxrwxrwx 1 1024 users 181027 Apr 12 2001 vmware.log
    -rwxrwxrwx 1 1024 users 217055232 Apr 12 2001 vmx-DECY01-VSRV-SQL1-2057826254-1.vswp

    –Here is the contents of DECY01-VSRV-SQL1-flat.vmdk–

    root@xss03-vsrv-lnxtst:/mnt/sql-E# mmls -t dos /mnt/sql1/DECY01-VSRV-SQL1-flat.vmdk.raw DOS Partition Table
    Offset Sector: 0
    Units are in 512-byte sectors

    Slot Start End Length Description
    00: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
    01: —– 0000000000 0000000062 0000000063 Unallocated
    02: 00:00 0000000063 0000002047 0000001985 Win LVM / Secure FS (0×42)
    03: 00:01 0000002048 0125827071 0125825024 Win LVM / Secure FS (0×42)

    –Here is the contents of DECY01-VSRV-SQL1_2-flat.vmdk–

    root@xss03-vsrv-lnxtst:/mnt/sql-E# mmls -t dos /mnt/sql1_2-flat/DECY01-VSRV-SQL1_2-flat.vmdk.raw
    DOS Partition Table
    Offset Sector: 0
    Units are in 512-byte sectors

    Slot Start End Length Description
    00: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
    01: —– 0000000000 0000000062 0000000063 Unallocated
    02: 00:00 0000000063 0041940991 0041940929 Win LVM / Secure FS (0×42)
    03: —– 0041940992 0041943039 0000002048 Unallocated

    –All other vmdk files are either super small or when trying to do the mmls command returned error:
    Sector offset supplied is larger than disk image (maximum:0)

    –The one that mounts correctly is DECY01-VSRV-SQL-flat.vmdk.–

    root@xss03-vsrv-lnxtst:/home/service# mmls -t dos /mnt/sql-flat/DECY01-VSRV-SQL-flat.vmdk.raw
    DOS Partition Table
    Offset Sector: 0
    Units are in 512-byte sectors

    Slot Start End Length Description
    00: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
    01: —– 0000000000 0000002047 0000002048 Unallocated
    02: 00:00 0000002048 0085979135 0085977088 NTFS (0×07)
    03: —– 0085979136 0085983231 0000004096 Unallocated

    Thanks again.

    • Ok so in the virtual machine itself the “disk” was set up as a LVM disk? So when the VM was created the disks IN the VM were set up as LVM and then formatted NTFS?

      Then yes it makes sense that you might need to mount the drive using LVM tools first, and that will probably have it show up correctly.

      But I haven’t done anything with LVM (especially with VMDK’s) to know enough of what to do.

      Good luck….


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


Follow

Get every new post delivered to your Inbox.

%d bloggers like this: