Mounting VMDK files in Linux

06Jan13

Hello everyone!

Well it’s been a while since I’ve posted and I apologize for that.  I do have some ideas for posts “in the hopper” but I haven’t had a chance to sit down and really work on them.  I’m hoping with some “life changes” coming up this year I’ll have the opportunity to write more.  But we’ll see.

Anyway, I was looking for an easy way to mount VMDK files on my Linux box so I could do forensic analysis on the images.  Similar to how I’ve done things in the past with E01 files.  I didn’t really want to image the VM and then analyze it, since most of the time I’m using VM’s for testing.

So this will be short and sweet, but first a couple of caveats:

1) I have not tested this against split VMDK files yet, but I’m thinking it should work.

2) I haven’t even considered testing this against VM snapshot images, but I’m guessing that will not work.

3) You need to have AFFLIB installed and working

That being said, this post was inspired by Sketchymoose’s post

She talks about downloading the Virtual Disk Development kit, but one item in the post caught my eye:

“I first discovered I had to add the ‘-i aff’ parameter to get mmls to determine the disk structure of the vmdk file.”

I thought hey, there’s affuse!

Step 1:

affuse <vmdk file> /mount/point

ex: affuse windows7.vmdk /mnt/aff

Step 2:

mmls -t dos <mount point>/<vmdk file name>.raw

ex: mmls -t dos /mnt/aff/windows7.vmdk.raw

Step 3:

mount -o ro,loop,show_sys_files,streams_interface=windows,offset=<offset> <mount point>/<vmdk file>.raw /mount/point

ex: mount -o ro,loop,show_sys_files,streams_interface=windows,offset=1048576 /mnt/aff/windows7.vmdk.raw /mnt/windows

And voila!  /mnt/windows now contains the file structure of the VMDK image!

I’m sure someone else figured this out, but a google search didn’t come up with anything when I added AFF to the search query (for me at least).  So I thought I would share…

Also, keep in mind you can still use the -i AFF with TSK and VMDK images if you don’t need to mount it…

About these ads


12 Responses to “Mounting VMDK files in Linux”

  1. Well done and easy to follow. Thanks for sharing! Looking very forward to trying it out!

  2. Make your life easy and use Windows!

  3. Ehem…

    guestmount(1)

    • Or rather, vdfuse(1).

      guestmount(1) mounts the filesystems, vdfuse(1) exposes the whole device and any partitions in it much like device nodes in /dev, but as regular files instead of block devices.

  4. Oooh, hadn’t heard of guestmount before….I’ll have to check it out. Thanks for the info!

  5. Hmm is anyone else having problems with the images on
    this blog loading? I’m trying to determine if its a problem on my end or if it’s the blog.
    Any feedback would be greatly appreciated.

  6. 8 FL1SK

    Just use vmware-mount its much much easier ;-)

  7. 9 Drask

    Thanks a bunch, I never knew this could be done. Many is the time I wished I could pull some files out of a VM image.

    You might want to mention that you need to multiply the start point returned by mmls by the sector size when passing the offset to mount. For instance:

    DOS Partition Table
    Offset Sector: 0
    Units are in 512-byte sectors

    Slot Start End Length Description
    00: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
    01: —– 0000000000 0000000055 0000000056 Unallocated
    02: 00:00 0000000056 0083886079 0083886024 NTFS (0×07)

    To mount the NTFS partition, the line would need to be:

    mount -t ntfs -o ro,loop,show_sys_files,streams_interface=windows,offset=28672 /.raw

    since 28672 is 56*512.

  8. 10 ricci

    I tries the above with split vmdk files. Though affuse seems to be working, and mmls also shows the partition, but when I mount using the same command set, it cannot mount the win 7 partition.

    After using vdisk manager tool to combine them to one disk image, then it works.

    So seems that the vmdk file has to be combined. Any other method I can view the disk and extract content from it without combining the disk?4

  9. Works great here, I’ll be adding this to the forensic curriculum I instruct. Kudos to your diligent and alert work.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


Follow

Get every new post delivered to your Inbox.

%d bloggers like this: