Hi Everybody,
I am working for the Dutch Forensics Insitute, and I am working on a library (in Java) that needs to read VMWare ESX Server (vmdk) images. I have a hard time finding a true sparse VMware ESX image (identified by the magic bytes DOWC at the beginning of the file).
Does someone know where I can find a small sparse VMware ESX Server image that I can use to test my code?
Not really an answer to your question oops , but here is the place to go for VMWare related thingies
http//
Maybe if you ask on that Forum Sanbarrow or some of the other guys may be able to help you.
jaclaz
Hi,
Thank you, I was hopeful that the downloads in the forum (two VMware ESX images) were actual ESX images. But the more I am investigating this, the more I have the feeling I am chasing ghosts. There is a legacy format, but there is no ESX Server VMDK that is written according to the old format, they all seem to use the newer Hosted / VMware Workstation format.
I registered to the forum, and will post my question there shortly..
- Jorgen Bodde
Nederlands Forensisch Insituut
Den Haag
The Netherlands
DOWC ? - are you sure ?
ESX-snapshots nowadays use an external descriptor plus a datafile that starts with COWD.
The createType entry in the descriptor says "vmfsSparse" in this case.
Maybe you talk about the type VMFS as thin provisioned ?
they all seem to use the newer Hosted / VMware Workstation format.
Thats not quite correct.
Since ESX 3 the format looks similar to the format used on Workstation.
But the "createType" entry in the descriptor is different.
ESX use "VMFS" while the same disk also could be used as "monolithicFlat" in Workstation.
Here I show how to change the types …
http//
Maybe this table is useful for you ?
http//
Do you know the Java based Fvmfs driver ? - that one can be used from a Linux or Windows LiveCD to read VMFS-filesystem.
Check http//
It is a nice-to-have-tool in case you have to recover files from VMFS.
By the way - to inspect vmdks that were used on a ESX host - copy them to a Windows-host and use the files with VMware Workstation 6.5.3
This is undocumented but it works …
Ulli