dissect.hypervisor.disk.vdi

Module Contents

Classes

VDI

VirtualBox Virtual Disk Image (VDI) implementation.

VDIStream

Basic buffered stream that provides aligned reads.
class dissect.hypervisor.disk.vdi.VDI(fh: BinaryIO | pathlib.Path, parent: BinaryIO | None = None)

VirtualBox Virtual Disk Image (VDI) implementation.

Use :method:`open` to get a stream for reading from the VDI file. The stream will handle reading from the parent disk if necessary (and provided).

If provided with a file-like object, the caller is responsible for closing it. When provided with a path, the VDI class will manage the file handle.

If providing a parent file-like object, the caller is responsible for the lifecycle of that object.

Parameters:

  • fh – File-like object or path of the VDI file.

  • parent – Optional file-like object for the parent disk (for differencing disks).

parent = None
preheader
header
__enter__() → Self
__exit__(exc_type: type[BaseException] | None, exc_value: BaseException | None, traceback: types.TracebackType | None) → None
property type: dissect.hypervisor.disk.c_vdi.c_vdi.VDI_IMAGE_TYPE

The type of the VDI file.

property flags: dissect.hypervisor.disk.c_vdi.c_vdi.VDI_IMAGE_FLAGS

The flags of the VDI file.

property size: int

The size of the virtual disk.

property block_size: int

The size of each block in the VDI file.

property data_offset: int

The offset to the data blocks.

property blocks_offset: int

The offset to the block allocation table.

property number_of_blocks: int

The number of blocks in the VDI file.

open() → VDIStream

Open a stream to read from the VDI file.

close() → None

Close the VDI file handle.

class dissect.hypervisor.disk.vdi.VDIStream(vdi: VDI)

Bases: dissect.util.stream.AlignedStream

Basic buffered stream that provides aligned reads.

Must be subclassed for various stream implementations. Subclasses can implement:

  • _read()

  • _seek()

The offset and length for _read are guaranteed to be aligned for streams of a known size. If your stream has an unknown size (i.e. size == None), reads of length -1 (i.e. read until EOF) will be passed through to your implementation of _read. The only time that overriding _seek would make sense is if there’s no known size of your stream, but still want to provide SEEK_END functionality.

Most subclasses of AlignedStream take one or more file-like objects as source. Operations on these subclasses, like reading, will modify the source file-like object as a side effect.

Parameters:

  • size – The size of the stream. This is used in read and seek operations. None if unknown.

  • align – The alignment size. Read operations are aligned on this boundary. Also determines buffer size.

_read(offset: int, length: int) → bytes

Read method that backs this aligned stream.

_seek(pos: int, whence: int = 0) → int

Calculate and return the new stream position after a seek.

vdi
block_size
fh
map