Skip to content

VMDK: Add support for nativeParentCID and nativeParentHint #75

@cccs-ian

Description

@cccs-ian

Hey,

I have come across a vmdk file that uses nativeParentCID and nativeParentHint rather than parentCID and parentFileNameHint. My understanding is that this is likely related to snapshots, some documentation of these fields lives here: https://knowledge.broadcom.com/external/article/341651/understanding-virtual-machine-snapshots.html

Workstation also complains about the missing nativeParent disk if you import the vmdk there.

I figure that a simple fix is to ensure that dissect runs similar functionality as it currently does for parentCID and parentFileNameHint. Happy to work on this if this solution is seems credible.

Sample metadata:

# Disk DescriptorFile
version=1
CID=8132ea2e
parentCID=ffffffff
createType="streamOptimized"

# Extent description
RDONLY 629145600 SPARSE "generated-stream.vmdk"

# The Disk Data Base
#DDB

ddb.adapterType = "lsilogic"
ddb.geometry.cylinders = "39162"
ddb.geometry.heads = "255"
ddb.geometry.sectors = "63"
ddb.longContentID = "76c52202963e32181fc68f3e441ce7e2"
ddb.nativeDeltaBytes = "100962250752"
ddb.nativeDeltaBytesIsEstimate = "yes"
ddb.nativeParentCID = "8c5389b7"
ddb.nativeParentHint = "disk-name.vmdk"
ddb.toolsInstallType = "1"
ddb.toolsVersion = "12421"
ddb.virtualHWVersion = "9"

I am unable to provide the vmdk files for testing.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions