Persediaan Forensic utk vmdk

File vmdk ada 2 jenis:
1- compress vmdk. (yg di eksport ke ovf, akan ada file vmdk juga)
2- normal vmdk file



---Jenis Pertama(Compress)------
Header file spt berikut


$ cat mydisk-1.vmdk | head -n 24
KDMV
����������


# Disk DescriptorFile
version=1
CID=c5c13606
parentCID=ffffffff
createType="streamOptimized"


# Extent description
RDONLY 167772160 SPARSE "generated-stream.vmdk"


# The Disk Data Base
#DDB


ddb.adapterType = "lsilogic"
ddb.deletable = "true"
ddb.geometry.cylinders = "10443"
ddb.geometry.heads = "255"
ddb.geometry.sectors = "63"
ddb.longContentID = "00302ffb1ab341039d5bd86cdfdc2093"
ddb.toolsInstallType = "1"
ddb.toolsVersion = "10305"
ddb.virtualHWVersion = "13"





-------Jenis Ke-2 (Normal vmdk)---------------
Header file spt berikut:

$ cat mydisk-disk1.vmdk | head -n 26
KDMV
�)(�P

# Disk DescriptorFile
version=1
encoding="windows-1252"
CID=5760ddb4
parentCID=ffffffff
createType="monolithicSparse"

# Extent description
RW 167772160 SPARSE "mydisk-disk1.vmdk"

# The Disk Data Base
#DDB

ddb.adapterType = "lsilogic"
ddb.deletable = "true"
ddb.geometry.cylinders = "10443"
ddb.geometry.heads = "255"
ddb.geometry.sectors = "63"
ddb.longContentID = "759eeb7f459530d2044013365760ddb4"
ddb.toolsInstallType = "1"
ddb.toolsVersion = "10305"
ddb.uuid = "60 00 C2 9d 9d 85 7f 58-7b d8 30 ac 1b ae 1d bb"
ddb.virtualHWVersion = "13"

--------Mounting-Jenis 2(normal)--------

0) sudo -i    (attemp using normal user with sudo, failed)
1) affuse mydisk.vmdk mnt_affuse/point/

2) mmls mnt_affuse/point/mydisk.vmdk.raw  (utk dapatkan offset(start * 512(bytes size per sector)))

3) mount -o ro,loop,show_sys_files,streams_interface=windows,offset=_offset_number_   mnt_affuse/point/mydisk.vmdk.raw  mnt_dir/point
  
4) do your work/analysis on mnt_dir/point

5) umount mnt_dir/point
6) fusermount -u mnt_affuse/point/

##notes about losetup##
On step3, will result /dev/loopX being created
Can  check with losetup -l   (to list)
losetup -f (check next available number loopX)

On step5, will remove /dev/loopX

##Notes about Steps 0##
Alternatively you can ommit steps 0, but must use sudo for steps 1, 2, 3

--------Mounting-Jenis 1(compress vmdk)--------

1) kena import dulu ova tersebut. (ini akan hasil kan vmdk yg normal)

2) teruskan langkah mounting Jenis 2 diatas.







Ref:
1) https://sanbarrow.com/vmdk-howtos.html