mnrkbys / vss_carver

Carves and recreates VSS catalog and store from Windows disk image.
MIT License
96 stars 23 forks source link

Renamed VMDK's won't parse [bug] #16

Closed BeanBagKing closed 2 years ago

BeanBagKing commented 2 years ago

I discovered something odd. I have a vmdk from a test system, it was created as "Windows Server 2012.vmdk". I moved the disk to a different path and renamed it to remove spaces and make it easier to type, "server2012.vmdk". When I run vss_carver.py, something is still looking for the original file name. I don't know how it got this, I assume it's pulling it from the metadata somewhere. If I rename it back, it runs fine (with fine being it's still not finding VSS volume header, but it's not crashing).

Behavior after changing the original file name (scroll all the way right):

$ python3 vss_carver.py -t vmdk -o 718848 -i /mnt/c/vss_test/server2012.vmdk -c /mnt/c/vss_test/
catalog2012 -s /mnt/c/vss_test/store2012
vss_carver 20200312
Traceback (most recent call last):
  File "/home/nullsec/vss_carver/vss_carver.py", line 953, in <module>
    sys.exit(main())
  File "/home/nullsec/vss_carver/vss_carver.py", line 896, in main
    disk_image.open_extent_data_files()
OSError: pyvmdk_handle_open_extent_data_files: unable to open extent data files. libcfile_file_open_with_error_code: no such file: /mnt/c/vss_test/Windows Server 2012.vmdk. libcfile_file_open: unable to open file. libbfio_file_io_handle_open: unable to open file: /mnt/c/vss_test/Windows Server 2012.vmdk. libbfio_handle_open: unable to open handle. libvmdk_handle_open_extent_data_file: unable to open file IO handle. libvmdk_handle_open_extent_data_files: unable to open extent data file: /mnt/c/vss_test/Windows Server 2012.vmdk.

behavior after restoring the original file name:

$ python3 vss_carver.py -t vmdk -o 718848 -i "/mnt/c/vss_test/Windows Server 2012.vmdk" -c /mnt/
c/vss_test/catalog2012 -s /mnt/c/vss_test/store2012
vss_carver 20200312
==================================================
Stage 1: Checking if VSS is enabled.
Volume size: 0x200
Not found VSS volume header.
mnrkbys commented 2 years ago

VMDK has Extent descriptions. I assume that libvmdk uses the filename of the VMDK in it, but this limitation is not relevant to vss_carver.