Skip to content

v0.3.0 — forensic recovery

Choose a tag to compare

View all tags
@h4x0r h4x0r released this 05 Jun 11:19
· 61 commits to main since this release
v0.3.0
1954d43

Pure-Rust read-only VMware VMDK reader. This release makes it the most capable VMDK library for forensics and recovery.

Highlights

Forensic recovery (unique to this crate) — VMware stores the grain tables twice; qemu-img/libvmdk read only the primary and fail when it is damaged.

  • enable_rgd_fallback() + dump/hash/map/verify --recover: read past a damaged primary grain directory through the redundant GD — both whole-GT-pointer and individual lost-entry recovery.
  • grain_directory_recovery() triage report + rgd_recovery_count() census.
  • validate_rgd() fixed to compare grain-table contents (not pointers), so healthy two-copy images no longer false-positive.

Forensic metadata qemu-img/libvmdk discard

  • disk_database() — typed ddb.* (adapter, CHS geometry, UUID, HW/tools version, thin flag, encoding).
  • header_provenance() — unclean-shutdown flag, FTP-ASCII-mangling check, redundant-GD/compression/marker flags.
  • change_track_path() (CBT -ctk reference), effective_content_id() (longContentID sentinel), VMFSRDM raw-device-map extents.

Hardening & robustness

  • numGTEsPerGT capped at 512 (closes an allocation-amplification DoS).
  • Three cargo fuzz targets (open / read / recover) run in CI and on a schedule; bounds-checked throughout; zero unsafe.
  • 280+ tests; COWD/seSparse cross-validated byte-for-byte against qemu-img convert -O raw.

Install

[dependencies]
vmdk = "0.3"
cargo install vmdk-cli   # the `vmdk` binary
Assets 2
Loading