Skip to content

Releases: SecurityRonin/vmdk-forensic

v0.4.0 — reader/analyzer split

06 Jun 06:54
@h4x0r h4x0r
v0.4.0
0d82fa6

Choose a tag to compare

View all tags
v0.4.0 — reader/analyzer split Latest
Latest

Splits the project into a lean reader and a forensic analyzer, mirroring vhdx/vhdx-forensic and ewf/ewf-forensic.

New crate: vmdk-forensic 0.1.0

VmdkIntegrity — the evidence-grade analyzer. It reparses raw bytes (so it tolerates damaged images) and produces a severity-graded anomaly list via analyse():

  • validate_rgd() — redundant-GD adjudication by grain-table contents, not pointers
  • grain_directory_recovery() — per-entry RGD recovery triage
  • check_integrity() — dangling GD/GT/grain pointer scan (VMDK4 sparse + seSparse)
  • header_provenance() — unclean-shutdown / FTP-ASCII-mangling / flag bits
  • Fuzzed (fuzz_forensic), saturating/bounds-checked throughout.

vmdk 0.4.0 (breaking)

Slimmed to the read-coupled surface. Removed (now in vmdk-forensic): validate_rgd, grain_directory_recovery, check_integrity, header_provenance and their report types. Kept: the RGD-fallback recovery read path (enable_rgd_fallback, rgd_recovery_count) and all reading/metadata.

Migrate: reader.check_integrity() → vmdk_forensic::VmdkIntegrity::new(reader).check_integrity().

vmdk verify now analyzes through vmdk-forensic; verify --recover reports "Integrity: OK after recovery".

Install

[dependencies]
vmdk = "0.4"            # reader
vmdk-forensic = "0.1"   # + integrity analysis
Assets 2
Loading

v0.3.0 — forensic recovery

05 Jun 11:19
@h4x0r h4x0r
v0.3.0
1954d43

Choose a tag to compare

View all tags
v0.3.0 — forensic recovery

Pure-Rust read-only VMware VMDK reader. This release makes it the most capable VMDK library for forensics and recovery.

Highlights

Forensic recovery (unique to this crate) — VMware stores the grain tables twice; qemu-img/libvmdk read only the primary and fail when it is damaged.

  • enable_rgd_fallback() + dump/hash/map/verify --recover: read past a damaged primary grain directory through the redundant GD — both whole-GT-pointer and individual lost-entry recovery.
  • grain_directory_recovery() triage report + rgd_recovery_count() census.
  • validate_rgd() fixed to compare grain-table contents (not pointers), so healthy two-copy images no longer false-positive.

Forensic metadata qemu-img/libvmdk discard

  • disk_database() — typed ddb.* (adapter, CHS geometry, UUID, HW/tools version, thin flag, encoding).
  • header_provenance() — unclean-shutdown flag, FTP-ASCII-mangling check, redundant-GD/compression/marker flags.
  • change_track_path() (CBT -ctk reference), effective_content_id() (longContentID sentinel), VMFSRDM raw-device-map extents.

Hardening & robustness

  • numGTEsPerGT capped at 512 (closes an allocation-amplification DoS).
  • Three cargo fuzz targets (open / read / recover) run in CI and on a schedule; bounds-checked throughout; zero unsafe.
  • 280+ tests; COWD/seSparse cross-validated byte-for-byte against qemu-img convert -O raw.

Install

[dependencies]
vmdk = "0.3"
cargo install vmdk-cli   # the `vmdk` binary
Loading