search

libyal / libvhdi

Library and tools to access the Virtual Hard Disk (VHD) image format
GNU Lesser General Public License v3.0
122 stars 31 forks source link

access block allocation information from API and Python binding? #19

Closed LunfanZhang closed 3 weeks ago

LunfanZhang commented 3 weeks ago

as title libvhdi support to parse the VHDX/.avhdx image to get some details (include the length&offset of every extent) about extents? if yes, if this API are mapped to the python-vhdi?

joachimmetz commented 3 weeks ago

I have no idea what you are asking.

joachimmetz commented 3 weeks ago

Closing this for now, will reopen if question becomes more clear.

LunfanZhang commented 2 weeks ago

I am wondering that if this lib support to get the detail of extents ?

joachimmetz commented 2 weeks ago

VHDX is the version 2 format of VHD images, while AVHDX is a type of VHDX image used for differencing disks.

.avhdx is a file extension, that in your case you state is a differential image, and per https://github.com/libyal/libvhdi/blob/main/README that is supported

I assume that python-vhdi is a binding for the libvhdi project, but only exposes a limited set of APIs. Please correct me if I'm mistaken.

the binding is named libvhdi-python and uses the module name pyvhdi

An extent refers to a continuous block of data in a VHDX image, typically defined by its length and offset. Some tools or libraries provide functionality to retrieve this information. I am wondering that if this lib support to get the detail of extents ?

I understand what an extent is, but it is unclear what you specifically mean with it in the context of vhdx. A vhdx file consists of many different regions with different types of information https://github.com/libyal/libvhdi/blob/main/documentation/Virtual%20Hard%20Disk%20version%202%20(VHDX)%20image%20format.asciidoc#1-overview So do you mean a range of the storage image data stored in the VHDX file?

Can you elaborate on your use case? are you looking for the data in the block allocation table? or data about regions?

LunfanZhang commented 2 weeks ago

So do you mean a range of the storage image data stored in the VHDX file?

I understand there is different type of regions in the VHDX image, include metadata and actually blocks. and yes, simplify, the extent here refers to the block which has been populated. so, I presume the metadata should be the first extent, I test a window 10 vhdx image and parse the extent, and output is : [ { "offset": 0, "length": 16508780544 }, { "offset": 17817403392, "length": 771751936 }, { "offset": 18790481920, "length": 1409286144 }, { "offset": 20401094656, "length": 570425344 }, { "offset": 22414360576, "length": 1509949440 }, { "offset": 50398756864, "length": 33554432 }, { "offset": 54324625408, "length": 6291456 } ]

Can you elaborate on your use case? are you looking for the data in the block allocation table? or data about regions?

My use case is detecting the populated data in a vhdx image and write this data to the certain offset in a new Virtual Diks.

joachimmetz commented 2 weeks ago

My use case is detecting the populated data in a vhdx image and write this data to the certain offset in a new Virtual Diks.

If it is to patch the images, this is what libvhdi can already do this for you. If I recall correctly you'll also have to read the chain of parents. If you can elaborate a bit more on "why" you need to approach it in this way that might help with pointing you in an useful direction.

the extent here refers to the block which has been populated

The Block allocation table is currently not exposed via the API. But you'll not only need the offset and size but also the Payload block states. This could be added to the API and the Python binding, but not something that is on the priority list at the moment.