search

mitre / thumbtack

A web front-end providing a REST-ful API to mount and unmount forensic disk images
Apache License 2.0
21 stars 6 forks source link

Newer vmdk versions failing #8

Closed dmmartin13 closed 2 years ago

dmmartin13 commented 4 years ago

Recent attempts to mount vmdk images with version "VMware4 disk image" have failed due to an apparent lack of support from libvmdk. A workaround was found to use qemu-nbd to mount the images in a similar manner to the intermediate mount used by ewfmount. To mount a vmdk image, issue the following commands (using Ubuntu 16.04):

sudo modprobe nbd sudo qemu-nbd -c /dev/nbd0 -r /path/to/image.vmdk sudo imount /dev/nbd0

To unmount the nbd device: sudo qemu-nbd -d /dev/nbd0

One issue with the qemu-nbd technique is that there does not appear to be a good way to determine which image is mounted to which /dev/nbd device, but this can be handled through Thumbtack's internal state tracking.

dmmartin13 commented 3 years ago

This same approach has been found to be effective for vhdx format disk images as well. These scripts https://gist.github.com/allenyllee/0a4c02952bf695470860b27369bbb60d are a good starting point, but need to be adapted a bit to:

dmmartin13 commented 2 years ago

Fixed by 60befb630deed484b7bca4619ce466fd6539341d