View a vmdk file from Python?

Question

Is there any way to view the contents of a vmdk file from Python, and to be able to read files from it? (I have no need to write to it). If not, is there any way to mount a vmdk file on a host machine, or generally any other way to look at a vmdk file without attaching it to a VM and running it?

Answer 1

You can mount a VMDK as a local disk with Disk Mount Utility.

Answer 2

You may want to take a look at ctypes-vddk if you are looking to import modules for exfiltration of vmdk data through python. You can find the module here; http://code.google.com/p/ctypes-vddk/

Personally, if you are looking to leverage the VDDK API (via C++), you can use Virtual Disk Development Kit 5.5 and its corresponding API. The actually programming guide can also be found here: hxxp://pubs.vmware.com/vsphere-55/topic/com.vmware.ICbase/PDF/vddk55_programming.pdf. Additionally, there is a tool that implemented this which can be found here: http://sourceforge.net/projects/vfae/. Lastly, there was a writeup on the use of VDDK with regard to VMDK forensic analysis: hxxp://crucialsecurityblog.harris.com/2012/01/18/how-can-vmwares-virtual-disk-development-kit-help-the-forensic-examiner/

enjoy...