vmdk 0.1.0

Pure-Rust read-only VMware VMDK sparse disk image reader
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

# tests/data — VMDK Real-Image Corpus

Integration test fixtures and fuzz seed corpus.
`fuzz/corpus/fuzz_open/` symlinks here; files are not duplicated.

## Files

| File | Subformat | Virtual size | Supported | Origin | Notes |
|------|-----------|-------------|-----------|--------|-------|
| `minimal.vmdk` | monolithicSparse (v1) | 1 MiB | Yes | qemu-img 11.0.0 (macOS/ARM) | Primary integration test seed |
| `dfvfs_ext2.vmdk` | monolithicSparse (v1) | 4 MiB | Yes | dfvfs test corpus (libyal) | ext2 filesystem; VMware4 origin |
| `plaso_image.vmdk` | monolithicSparse (v1) | 100 KiB | Yes | plaso test corpus (log2timeline) | Real VMware Workstation 4 image; has non-zero grain data at virtual offset 1024 |
| `stream_opt.vmdk` | streamOptimized (v3) | 1 MiB | Yes | qemu-img 11.0.0 (macOS/ARM) | All-sparse empty disk; GD/GT layout identical to v1 |
| `flat.vmdk` | twoGbMaxExtentFlat | 1 MiB | Yes (open_path only) | qemu-img 11.0.0 (macOS/ARM) | Text descriptor; open() returns Err, open_path() succeeds |
| `flat-f001.vmdk` | (raw extent for flat.vmdk) | — | No (by design) | qemu-img 11.0.0 (macOS/ARM) | Raw extent data, no VMDK header; open() returns BadMagic |

"Not supported" means `VmdkReader::open` returns `Err`, not that it panics.
These files serve as regression seeds: the reader must not panic on any of them.

## Provenance

- **qemu-img** files: generated locally with qemu-img 11.0.0 on macOS (Apple Silicon).
- **dfvfs_ext2.vmdk**: from [log2timeline/dfvfs](https://github.com/log2timeline/dfvfs) `test_data/ext2.vmdk` (Apache 2.0).
- **plaso_image.vmdk**: from [log2timeline/plaso](https://github.com/log2timeline/plaso) `test_data/image.vmdk` (Apache 2.0). VMware Workstation 4 era (`virtualHWVersion=4`, `adapterType=ide`). 200-sector disk with real filesystem data.

## External validation (not committed)

These real-world VMDKs were validated against the reader but are too large to commit:

| File | Source | Size | Virtual size | Result |
|------|--------|------|-------------|--------|
| `Ubuntu Server v11.04 64-bit-cl1.vmdk` | pWnOS v2.0, VulnHub | 1.3 GB | 40 GiB | Opens OK; GD at sector 5151; MBR boot sector read from grain |

pWnOS v2.0 download: `https://download.vulnhub.com/pwnos/pWnOS_v2.0.7z`  
Validation: `cargo run -p vmdk-cli -- info "<path>"` reported `monolithicSparse`, 42,949,672,960 bytes. Grain lookup navigated GD→GT→grain at sector 10368, read 414 non-zero bytes (x86 MBR boot code).

## Regenerating qemu-img files

```sh
qemu-img create -f vmdk tests/data/minimal.vmdk 1M
qemu-img create -f vmdk -o subformat=streamOptimized tests/data/stream_opt.vmdk 1M
qemu-img create -f vmdk -o subformat=twoGbMaxExtentFlat tests/data/flat.vmdk 1M
```