vmspect 0.3.0

Blazing-fast static inspection, forensic analysis and information extraction library for virtual machine disk images (VMDK, RAW, QCOW2, VHD, VHDX, VDI).
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

use std::path::Path;
use vmspect::{inspect_with_progress, InspectionProgressEvent, Options};

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let args: Vec<String> = std::env::args().collect();
    let disk_path = if args.len() > 1 {
        Path::new(&args[1])
    } else {
        println!("Usage: cargo run --example basic_inspection -- <path_to_disk_image>");
        println!("Example: cargo run --example basic_inspection -- disk.vmdk");
        return Ok(());
    };

    let options = Options::default();

    println!("Starting inspection of '{}'...", disk_path.display());
    let report = inspect_with_progress(disk_path, &options, |p: InspectionProgressEvent| {
        println!(
            "[{:>3}%] {}{}",
            p.percentage,
            p.stage,
            p.detail.map(|d| format!(" - {}", d)).unwrap_or_default()
        );
    })?;

    println!("\n=== INSPECTION REPORT ===");
    println!(
        "Format: {} ({})",
        report.image.format,
        report.image.hypervisor.name()
    );
    println!("Partition scheme: {:?}", report.scheme);
    println!(
        "Operating system: {} {:?}",
        report.operating_system.icon(),
        report.operating_system
    );
    println!("OS details: {}", report.guest_info.formatted_os_string());
    if let Some(ref tools) = report.guest_info.guest_tools {
        if tools.present {
            println!(
                "Guest tools: {} (version: {})",
                tools.kind,
                tools.version.as_deref().unwrap_or("N/A")
            );
        }
    }
    println!("Partitions found: {}", report.partitions.len());
    for p in &report.partitions {
        println!(
            "  - #{} [{}] {} (start: 0x{:X}, size: {} bytes)",
            p.index,
            p.kind,
            p.file_system.name(),
            p.start,
            p.size
        );
    }
    println!("Programs identified: {}", report.installed_programs.len());
    for prog in report.installed_programs.iter().take(15) {
        println!(
            "  * {} (version: {}, publisher: {})",
            prog.name,
            prog.version.as_deref().unwrap_or("N/A"),
            prog.publisher.as_deref().unwrap_or("N/A")
        );
    }

    Ok(())
}