Python development

libvmdk comes with Python-bindings named pyvmdk.

Below are examples how use pyvmdk. They assume you have a working version of pyvmdk on your system. To build pyvmdk see Building.

Import

To be able to use pyvmdk in your Python scripts add the following import:

import pyvmdk

Get version

The get_version() module function can be used to retrieve the version of the pyvmdk.

pyvmdk.get_version()

This will return a textual string (Unicode) that contains the libvmdk version. Since pyvmdk is a wrapper around libvmdk it does not have a separate version.

Open handle

Open a handle by path

vmdk_handle = pyvmdk.handle()

vmdk_handle.open("image.vmdk")
vmdk_handle.open_extent_data_files()

...

vmdk_handle.close()

The explicit call to vmdk_handle.close() is not required. Close only must be called once all operations on the handle have been completed.

Open a handle using a file-like object

file_object = open("image.vmdk", "rb")

vmdk_handle = pyvmdk.handle()

vmdk_handle.open_file_object(file_object)
base_directory = os.path.dirname(filename)

extent_data_files = []
for extent_descriptor in vmdk_handle.extent_descriptors:
  extent_data_filename = extent_descriptor.filename

  _, path_separator, filename = extent_data_filename.rpartition("/")
  if not path_separator:
    _, path_separator, filename = extent_data_filename.rpartition("\\")

  if not path_separator:
    filename = extent_data_filename

  extent_data_file_path = os.path.join(base_directory, filename)

  if not os.path.exists(extent_data_file_path):
    break

  extent_data_files.append(extent_data_file_path)

if len(extent_data_files) != vmdk_handle.number_of_extents:
  raise RuntimeError("Unable to locate all extent data files.")

file_objects = []
for extent_data_file_path in extent_data_files:
  file_object = open(extent_data_file_path, "rb")
  file_objects.append(file_object)

vmdk_handle.open_extent_data_files_file_objects(file_objects)

...

vmdk_handle.close()

The explicit call to vmdk_handle.close() is not required. Close only must be called once all operations on the handle have been completed and will not close the file-like object itself.

Examples

Combining pyvmdk with pytsk3

The following additional import is required:

import pytsk3

class vmdk_Img_Info(pytsk3.Img_Info):
  def __init__(self, vmdk_handle):
    self._vmdk_handle = vmdk_handle
    super(vmdk_Img_Info, self).__init__(
        url="", type=pytsk3.TSK_IMG_TYPE_EXTERNAL)

  def close(self):
    self._vmdk_handle.close()

  def read(self, offset, size):
    self._vmdk_handle.seek(offset)
    return self._vmdk_handle.read(size)

  def get_size(self):
    return self._vmdk_handle.get_media_size()


vmdk_handle = pyvmdk.handle()

vmdk_handle.open("image.vmdk")
vmdk_handle.open_extent_data_files()

img_info = vmdk_Img_Info(vmdk_handle)

fs_info = pytsk3.FS_Info(img_info, offset=63 * 512)

Also see

import pyvmdk

help(pyvmdk)
help(pyvmdk.handle)