How to mount a .vmdk image in Linux

Mounting a .vmdk file in Linux makes life so much easier for CLI lovers. Affuse solves all the issues you could run into.

Method 1: AFFUSE

Mounting

1. Create a vmdk mountpoint:

				
					sudo mkdir /mnt/vmdk
				
			

2. Mount the VMDK

				
					sudo affuse /path/to/image.vmdk /mnt/vmdk
				
			

3. Check that the image mounted correctly

It should return /mnt/vmdk/yourimagename.vmdk.raw.

				
					sudo ls -la /mnt/vmdk
				
			

4. Look at the partition table to identify the starting offset of the partition of interest

				
					sudo mmls /mnt/vmdk/yourimagename.vmdk.raw
				
			


In this example, the Windows VM has two partitions. The main “C:/” partition starts at offset 206848. To mount it, you will have to multiply the offset by 512. In this case, 206848*512 = 105906176.

5. Create a mount point for the Virtual Machine

				
					sudo mkdir /mnt/VM
				
			

6. Mount the VM as a logical drive:

				
					sudo mount -o ro,loop,offset=105906176 /mnt/vmdk/yourimagename.vmdk.raw /mnt/VM
				
			

7. Check that all is mounted correctly

				
					ls -la /mnt/VM
				
			

Unmounting

1. Unmount the Virtual Machine

				
					sudo umount /mnt/VM
				
			

2. Unmount the .vmdk image

				
					sudo fusermount -u /mnt/vmdk
				
			

Method 2: Qemu

This section has been copied from Jason Murray’s blog post. Full credits go to him, and I highly suggest reading up his blog!!!

Mounting

1. Install qemu utils:

				
					sudo apt install qemu-utils
				
			

2. Enable network block device module

				
					sudo modprobe nbd
				
			

3. Create the network block device

				
					sudo qemu-nbd -r -c /dev/nbd1 /path/to/your/image.vmdk
				
			

4. List the images created & create mount points accordingly

				
					ls -la /dev/nbd1p* | sed 's/^.*nbd1p/\/mnt\/VM/g' | sudo xargs mkdir
				
			

This will create mountpoints /mnt/VM[i] for each partitions/images created by nbd.

5. Mount the images to the mountpoint

				
					ls -la /dev/nbd1p* | sed 's/^.*nbd1p/\/mnt\/VM/g' > mounts
for file in /dev/nbd1p*; do read line;  sudo mount "${file}" "${line}";  done < mounts
				
			

6. Find the partition of interest

				
					ls -la /mnt/VM*/
				
			

Unmounting

1. Unmount the Virtual Machine

				
					sudo umount /mnt/VM*
				
			

2. Detach the Network Block Device

				
					sudo qemu-nbd -d /dev/nbd1
				
			

TLDR

– Two methods presented to mount vmdk: affuse and qemu.
affuse is partition specific; qemu mounts all partitions.

Recent Posts

Follow Us

Featured Video

Guide

Discover more from forensicskween

Subscribe now to keep reading and get access to the full archive.

Continue reading

Exit mobile version
%%footer%%