dissect.hypervisor.disk.vhdx

Module Contents

Classes

VHDX	Hyper-V VHDX implementation.
RegionTable
BlockAllocationTable
ParentLocator
MetadataTable

Functions

open_parent

Attributes

log

dissect.hypervisor.disk.vhdx.log

class dissect.hypervisor.disk.vhdx.VHDX(fh: BinaryIO | pathlib.Path | str)

Bases: dissect.util.stream.AlignedStream

Hyper-V VHDX implementation.

Supports fixed, dynamic and differencing VHDX files.

Currently, differencing VHDX files must be passed as a pathlib.Path object, with the parent VHDX in the same directory, or the registered absolute directory.

fh

path

file_identifier

header

headers

region_table

region_tables

metadata

size

block_size

has_parent

sector_size

id

parent = None

parent_locator: ParentLocator = None

bat

read_sectors(sector: int, count: int) → bytes

class dissect.hypervisor.disk.vhdx.RegionTable(fh: BinaryIO, offset: int)

fh

offset

header

entries

lookup

get(guid: uuid.UUID, required: bool = True) → dissect.hypervisor.disk.c_vhdx.c_vhdx.region_table_entry | None

class dissect.hypervisor.disk.vhdx.BlockAllocationTable(vhdx: VHDX, offset: int)

vhdx

offset

chunk_ratio

get

pb(block: int) → dissect.hypervisor.disk.c_vhdx.c_vhdx.bat_entry

Get a payload block entry for a given block.

sb(block: int) → dissect.hypervisor.disk.c_vhdx.c_vhdx.bat_entry

Get a sector bitmap entry for a given block.

class dissect.hypervisor.disk.vhdx.ParentLocator(fh: BinaryIO)

fh

offset

header

type

entries: dict[str, str]

class dissect.hypervisor.disk.vhdx.MetadataTable(fh: BinaryIO, offset: int, length: int)

METADATA_MAP: Final[dict[uuid.UUID, Callable[[BinaryIO], Any]]]

fh

offset

length

header

entries

lookup

get(guid: uuid.UUID, required: bool = True) → Any | None

dissect.hypervisor.disk.vhdx.open_parent(path: pathlib.Path, locator: dict[str, str]) → VHDX