How to mount a .vmdk image in Linux

Mounting a .vmdk file in Linux makes life so much easier for CLI lovers. Affuse solves all the issues you could run into.

Method 1: AFFUSE

Mounting

1. Create a vmdk mountpoint:

				
					sudo mkdir /mnt/vmdk
				
			

2. Mount the VMDK

				
					sudo affuse /path/to/image.vmdk /mnt/vmdk
				
			

3. Check that the image mounted correctly

It should return /mnt/vmdk/yourimagename.vmdk.raw.

				
					sudo ls -la /mnt/vmdk
				
			

4. Look at the partition table to identify the starting offset of the partition of interest

				
					sudo mmls /mnt/vmdk/yourimagename.vmdk.raw
				
			


In this example, the Windows VM has two partitions. The main “C:/” partition starts at offset 206848. To mount it, you will have to multiply the offset by 512. In this case, 206848*512 = 105906176.

5. Create a mount point for the Virtual Machine

				
					sudo mkdir /mnt/VM
				
			

6. Mount the VM as a logical drive:

				
					sudo mount -o ro,loop,offset=105906176 /mnt/vmdk/yourimagename.vmdk.raw /mnt/VM
				
			

7. Check that all is mounted correctly

				
					ls -la /mnt/VM
				
			

Unmounting

1. Unmount the Virtual Machine

				
					sudo umount /mnt/VM
				
			

2. Unmount the .vmdk image

				
					sudo fusermount -u /mnt/vmdk
				
			

Method 2: Qemu

This section has been copied from Jason Murray’s blog post. Full credits go to him, and I highly suggest reading up his blog!!!

Mounting

1. Install qemu utils:

				
					sudo apt install qemu-utils
				
			

2. Enable network block device module

				
					sudo modprobe nbd
				
			

3. Create the network block device

				
					sudo qemu-nbd -r -c /dev/nbd1 /path/to/your/image.vmdk
				
			

4. List the images created & create mount points accordingly

				
					ls -la /dev/nbd1p* | sed 's/^.*nbd1p/\/mnt\/VM/g' | sudo xargs mkdir
				
			

This will create mountpoints /mnt/VM[i] for each partitions/images created by nbd.

5. Mount the images to the mountpoint

				
					ls -la /dev/nbd1p* | sed 's/^.*nbd1p/\/mnt\/VM/g' > mounts
for file in /dev/nbd1p*; do read line;  sudo mount "${file}" "${line}";  done < mounts
				
			

6. Find the partition of interest

				
					ls -la /mnt/VM*/
				
			

Unmounting

1. Unmount the Virtual Machine

				
					sudo umount /mnt/VM*
				
			

2. Detach the Network Block Device

				
					sudo qemu-nbd -d /dev/nbd1
				
			

TLDR

– Two methods presented to mount vmdk: affuse and qemu.
affuse is partition specific; qemu mounts all partitions.

Recent Posts

Follow Us

Featured Video

Guide

Discover more from forensicskween

Subscribe now to keep reading and get access to the full archive.

Continue reading