vmspect 0.4.1

Blazing-fast static inspection, forensic analysis and information extraction library for virtual machine disk images (VMDK, RAW, QCOW2, VHD, VHDX, VDI).
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

//! Models for partitions, schemes and file systems.

use serde::{Deserialize, Serialize};

/// Partition table scheme present in the virtual disk.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum PartitionScheme {
    /// Traditional Master Boot Record.
    Mbr,
    /// GUID Partition Table.
    Gpt,
    /// The disk lacks a partition table: the file system starts directly at sector 0.
    None,
}

/// Type of file system identified in a partition.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum FileSystem {
    /// New Technology File System (Windows).
    Ntfs,
    /// File Allocation Table (FAT12/FAT16/FAT32/exFAT).
    Fat,
    /// Second Extended Filesystem (Linux).
    Ext2,
    /// Third Extended Filesystem (Linux).
    Ext3,
    /// Fourth Extended Filesystem (Linux).
    Ext4,
    /// High-performance journaling file system (Linux).
    Xfs,
    /// B-tree file system (Linux).
    Btrfs,
    /// Linux swap partition.
    LinuxSwap,
    /// LVM2 Physical Volume (Linux Logical Volume Manager).
    Lvm2,
    /// Unrecognized or unsupported file system.
    Unknown,
}

impl FileSystem {
    /// Returns whether the file system natively belongs to the Linux ecosystem.
    pub fn is_linux(&self) -> bool {
        matches!(
            self,
            FileSystem::Ext2
                | FileSystem::Ext3
                | FileSystem::Ext4
                | FileSystem::Xfs
                | FileSystem::Btrfs
                | FileSystem::LinuxSwap
                | FileSystem::Lvm2
        )
    }

    /// Friendly, standardized name of the file system.
    pub fn name(&self) -> &'static str {
        match self {
            FileSystem::Ntfs => "NTFS",
            FileSystem::Fat => "FAT",
            FileSystem::Ext2 => "ext2",
            FileSystem::Ext3 => "ext3",
            FileSystem::Ext4 => "ext4",
            FileSystem::Xfs => "XFS",
            FileSystem::Btrfs => "Btrfs",
            FileSystem::LinuxSwap => "Linux swap",
            FileSystem::Lvm2 => "LVM2 PV",
            FileSystem::Unknown => "unknown",
        }
    }
}

/// General classification of the guest operating system family.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum OperatingSystem {
    /// Microsoft Windows operating systems.
    Windows,
    /// Linux distributions.
    Linux,
    /// Unidentified or unsupported operating system.
    Unknown,
}

impl OperatingSystem {
    /// Returns a representative emoji for the operating system, for console UIs.
    pub fn icon(&self) -> &'static str {
        match self {
            OperatingSystem::Windows => "🪟",
            OperatingSystem::Linux => "🐧",
            OperatingSystem::Unknown => "❓",
        }
    }
}

/// Representation of a physical partition located inside the virtual disk.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Partition {
    /// Sequential index of the partition within the table.
    pub index: usize,
    /// Absolute offset in bytes where the partition starts on the virtual disk.
    pub start: u64,
    /// Total size of the partition expressed in bytes.
    pub size: u64,
    /// Declared partition type (MBR byte or translated GPT GUID).
    pub kind: String,
    /// File system detected by inspecting the signature of the first sector of the partition.
    pub file_system: FileSystem,
    /// Optional label or volume name assigned to the partition.
    pub label: Option<String>,
}

impl Partition {
    /// Returns `true` if the partition's file system is NTFS.
    pub fn is_ntfs(&self) -> bool {
        matches!(self.file_system, FileSystem::Ntfs)
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_file_system() {
        assert!(FileSystem::Ext4.is_linux());
        assert!(!FileSystem::Ntfs.is_linux());
        assert_eq!(FileSystem::Ntfs.name(), "NTFS");
    }
}