VHDX
Definition
Microsoft's second-generation virtual hard disk format, used by Hyper-V and recent Windows containers. Supports up to 64 TB, has block-level CRC, and is the default for new Hyper-V VMs since Windows Server 2012.
- Developer
- Microsoft
- Platform
- Hyper-V and recent Windows containers
- Max size
- 64 TB
- Resiliency feature
- Block-level CRC checksums
- Default since
- Windows Server 2012
Common questions
How does VHDX differ from the older VHD format?+
VHDX supports far larger virtual disks, up to 64 TB versus 2 TB for VHD, adds block-level checksums that protect against corruption during a power failure, and handles modern large-sector physical disks better.
Why does the VHDX format matter to a forensic examiner?+
Investigating a virtualised or cloud-backed endpoint often means mounting or parsing a VHDX container directly to reach the guest virtual machine's file system, so tool support for the format affects what evidence can be recovered.
Related terms
- Files on-Demand
- Microsoft OneDrive feature that represents cloud-only files as 0-byte placeholders on the local NTFS volume, marked with a reparse tag IO_REPARSE_TAG_CLOUD. The...
- Qcow2
- QEMU Copy-On-Write version 2. The native disk format for QEMU and KVM hypervisors, with built-in snapshot, compression and encryption support. Used widely...
- Reparse Point
- An NTFS attribute that redirects file access to another handler. Cloud providers use reparse tags to insert their sync drivers between the...
- Snapshot Chain
- A parent VMDK or VHDX plus one or more child differential disks. Each child captures changes since its parent was snapshotted. Reading...
- VMDK
- VMware Virtual Machine Disk. The on-host file that holds the guest VM's disk contents, either as a monolithic file or split into...