VMware ESX Server I...
 
Notifications
Clear all

VMware ESX Server Image

4 Posts
3 Users
0 Reactions
757 Views
(@jorgb)
New Member
Joined: 16 years ago
Posts: 2
Topic starter  

Hi Everybody,

I am working for the Dutch Forensics Insitute, and I am working on a library (in Java) that needs to read VMWare ESX Server (vmdk) images. I have a hard time finding a true sparse VMware ESX image (identified by the magic bytes DOWC at the beginning of the file).

Does someone know where I can find a small sparse VMware ESX Server image that I can use to test my code?


   
Quote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Not really an answer to your question oops , but here is the place to go for VMWare related thingies
http//www.sanbarrow.com/

Maybe if you ask on that Forum Sanbarrow or some of the other guys may be able to help you.

jaclaz


   
ReplyQuote
(@jorgb)
New Member
Joined: 16 years ago
Posts: 2
Topic starter  

Hi,

Thank you, I was hopeful that the downloads in the forum (two VMware ESX images) were actual ESX images. But the more I am investigating this, the more I have the feeling I am chasing ghosts. There is a legacy format, but there is no ESX Server VMDK that is written according to the old format, they all seem to use the newer Hosted / VMware Workstation format.

I registered to the forum, and will post my question there shortly..

- Jorgen Bodde
Nederlands Forensisch Insituut
Den Haag
The Netherlands


   
ReplyQuote
(@sanbarrow)
Eminent Member
Joined: 17 years ago
Posts: 23
 

DOWC ? - are you sure ?

ESX-snapshots nowadays use an external descriptor plus a datafile that starts with COWD.

The createType entry in the descriptor says "vmfsSparse" in this case.

Maybe you talk about the type VMFS as thin provisioned ?

they all seem to use the newer Hosted / VMware Workstation format.

Thats not quite correct.
Since ESX 3 the format looks similar to the format used on Workstation.
But the "createType" entry in the descriptor is different.
ESX use "VMFS" while the same disk also could be used as "monolithicFlat" in Workstation.
Here I show how to change the types …
http//sanbarrow.com/vmdk/monolithicFlat-with-WS-and-ESX.html

Maybe this table is useful for you ?
http//sanbarrow.com/vmdk/disktypes.html

Do you know the Java based Fvmfs driver ? - that one can be used from a Linux or Windows LiveCD to read VMFS-filesystem.
Check http//code.google.com/p/vmfs/

It is a nice-to-have-tool in case you have to recover files from VMFS.

By the way - to inspect vmdks that were used on a ESX host - copy them to a Windows-host and use the files with VMware Workstation 6.5.3

This is undocumented but it works …

Ulli


   
ReplyQuote
Share: