List blocks/sectors/files in a delta VMDK file.

Moderator: continuum

List blocks/sectors/files in a delta VMDK file.

Postby SuperDuck » Sun Jan 09, 2011 3:17 pm

Hi there,

Nice tool collection in the VMDK handbook. I'm looking for a way to list included sectors in a sparse / delta VMDK file, so I can use an MS tool in the guest to list affected NTFS files in a given snapshot for malware analysis.. Is there a tool to list modified sectors in a delta VMDK file?

Yes, I use change trackers in the guest for this, but unfortunately they can't catch everything somehow.

Thanks!
SuperDuck
 
Posts: 1
Joined: Sun Jan 09, 2011 2:11 pm

Re: List blocks/sectors/files in a delta VMDK file.

Postby continuum » Mon Jan 10, 2011 3:36 pm

Hi
interesting task
Is there a tool to list modified sectors in a delta VMDK file?


Hmm - I never heard about something like that.
You could mount base-vmdk and base-vmdk with snapshot and then use a directory-diff tool ...

Ulli
continuum
 
Posts: 57
Joined: Tue Sep 28, 2010 8:39 pm


Return to VMware hackers lounge

Who is online

Users browsing this forum: No registered users and 0 guests

cron