VMDK
Definition
VMware Virtual Machine Disk. The on-host file that holds the guest VM's disk contents, either as a monolithic file or split into 2 GB chunks. Sparse, preallocated and stream-optimised variants exist.
- Full name
- VMware Virtual Machine Disk
- Holds
- The guest VM's disk contents
- File layout
- Monolithic, or split into 2 GB chunks
- Variants
- Sparse, preallocated, stream-optimised
Common questions
Why does the sparse versus preallocated distinction matter to an examiner?+
A sparse VMDK only stores blocks that have actually been written, so the file size understates the virtual disk's full capacity and unallocated space within it may not be present in the file at all, affecting what deleted-data recovery is even possible.
Can standard disk forensic tools mount and image a VMDK directly?+
Most modern forensic suites and libraries such as libvmdk can parse and mount VMDK files as a virtual disk, but split multi-file VMDKs and encrypted or snapshotted VMDK chains need all constituent files present and in the correct relationship to reconstruct correctly.
Related terms
- Files on-Demand
- Microsoft OneDrive feature that represents cloud-only files as 0-byte placeholders on the local NTFS volume, marked with a reparse tag IO_REPARSE_TAG_CLOUD. The...
- Qcow2
- QEMU Copy-On-Write version 2. The native disk format for QEMU and KVM hypervisors, with built-in snapshot, compression and encryption support. Used widely...
- Reparse Point
- An NTFS attribute that redirects file access to another handler. Cloud providers use reparse tags to insert their sync drivers between the...
- Snapshot Chain
- A parent VMDK or VHDX plus one or more child differential disks. Each child captures changes since its parent was snapshotted. Reading...
- VHDX
- Microsoft's second-generation virtual hard disk format, used by Hyper-V and recent Windows containers. Supports up to 64 TB, has block-level CRC, and...