search

libyal / libvmdk

Library and tools to access the VMware Virtual Disk (VMDK) format
GNU Lesser General Public License v3.0
168 stars 66 forks source link

Handle renamed single monolithic sparse images #7

Closed uckelman closed 2 years ago

uckelman commented 8 years ago
  1. Create a monolithicSparse type VMDK named foo.vmdk.
  2. Rename it to bar.vmdk.
  3. Try opening bar.vmdk with libvmdk.
  4. Get this error:
error: Error opening image file (src/vmdk.cpp:104: libvmdk_handle_open_extent_data_files: unable to read grain table.)
Had an error opening the evidence file
 ** seg[0] = /home/juckelman/projects/test-files/bar.vmdk

The cause is easy to see in the embedded descriptor file:

# Extent description
RW 3584001 SPARSE "foo.vmkd"

libvmdk is looking for the extents in foo.vmdk, but not finding it because the file has been renamed.

Renamed monolithic images are a fairly common thing to encounter. Some other tools, such as VirtualBox, are able to open renamed monolithicSparse images. I've tried to determine what behavior is mandated by the spec---specifically:

The Virtual Disk Format 1.1 spec says (p. 18):

An embedded disk descriptor can be used only when the first extent of a link is sparse

The Virtual Disk Format 5.0 spec (p. 3) says:

monolithicSparse - single sparse extent with embedded descriptor file

Based on this, it appears that the correct behavior for monolithicSparse images is to ignore the filename given in the descriptor for the single extent and instead use for the extent filename the filename of the file containing the descriptor.

Does this fit your understanding of things? If so, I'll work up a patch to make libvmdk behave this way.

joachimmetz commented 8 years ago

Does this fit your understanding of things?

Yes, from https://github.com/libyal/libvmdk/blob/master/ChangeLog#L15

* if there is a single filename in the disk database and the current file is
  not a descriptor-only file assume the current file is the right one even if
  the names don't match

In this regard we can adopt the most flexible behavior. I'd noted this but have not implemented it yet.

If so, I'll work up a patch to make libvmdk behave this way.

That would be helpful, thanks.

uckelman commented 8 years ago

Fixed in PR #8.

joachimmetz commented 8 years ago

PR does not fix the issue correctly:

Hence I've started making some changes: https://github.com/libyal/libvmdk/commit/d49417204576ca8988a4827ca5e92d5e212e091b

Not finished yet, but I'll close the PR

welkomier commented 3 years ago

The same happens not only for "monolithic sparse" format but also for e.g. "stream optimized". Is the issue fixed by now?

joachimmetz commented 3 years ago

@welkomier yes, very simple, just rename the file back to its original name.