虚拟磁盘 | 数据恢复实验室 Data Recovery Laboratory

以下是VirtualBox虚拟机磁盘结构的WinHex模板，研究此结构的可以借鉴。

template "VirtualBox虚拟机磁盘结构 v1.1"
description "VirtualBox虚拟机磁盘结构 v1.1"

sector-aligned
applies_to disk
requires 0x0 "3C 3C 3C 20 53 75 6E 20 56 69 72 74 75 61 6C 42 6F 78 20 44 69 73 6B 20 49 6D 61 67 65 20 3E 3E 3E"

begin

Char[64] "标签"
Hex 4 "标签 7F 10 DA BE"
Uint16 "版本号高"
Uint16 "版本号低"
Uint32 "结构大小(字节)" //从当前位置开始
Hex 4 "磁盘类型" //1动态扩展 2固定大小
Hex 4 "镜像标志"
char[256] "镜像备注"
UInt32 "offBlocks"
UInt32 "数据区起始偏移地址(字节)"
Section "老标准"
UInt32 "柱面"
UInt32 "磁头"
UInt32 "扇区"
UInt32 "扇区大小(字节)"
Section ""
Uint32 "BIOS的硬盘转换模式(现在未用)"
Int64 "虚拟磁盘大小(字节)"
UInt32 "块大小字节数"
Uint32 "附加块"
UInt32 "块总数"
UInt32 "使用中的块数"
numbering 1
section "镜像 UUID"
{
read-only guid "GUID (GUID~)"
move -16
hex 16 "GUID (HEX~)"
section ""
}[4]
Section "新标准"
UInt32 "柱面(新建时为0)"
UInt32 "磁头(新建时为0)"
UInt32 "扇区(新建时为0)"
UInt32 "扇区大小(字节)"

Section "说明："
Section ""
Section "位图项总数=要新建虚拟硬盘大小(GB)*1024"
Section ""
Section "vdi虚拟硬盘文件大小(字节)="
Section "要新建虚拟硬盘大小(GB)*1024*4+512"
Section ""
Section "一块大小为2048扇区1048576字节1MB)"

end

Windows 8中支持的VHDX虚拟磁盘格式，以下是虚拟磁盘结构代码。

//Structure 1: File Type Identifier
struct VHDX_FILE_IDENTIFIER {
	UINT64 	Signature;
	UINT16 	Creator[256];
};

//Structure 2: Header
struct VHDX_HEADER {
	UINT32 	Signature;
	UINT32 	Checksum;
	UINT64 	SequenceNumber;
	GUID 		FileWriteGuid;
	GUID 		DataWriteGuid;
	GUID 		LogGuid;
	UINT16 	LogVersion;
	UINT16 	Version;
	UINT32 	LogLength;
	UINT64 	LogOffset;
	UINT8[502] 	Reserved;
};

//Structure 3: Region Table Header
struct VHDX_REGION_TABLE_HEADER {
	UINT32 	Signature;
	UINT32 	Checksum;
	UINT32 	EntryCount;
	UINT32 	Reserved;
};

//Structure 4: Region Table Entry
struct VHDX_REGION_TABLE_ENTRY {
	GUID 		Guid;
	UINT64 	FileOffset;
	UINT32 	Length;
	UINT32 	Required:1;
	UINT32 	Reserved:31;
};

//Structure 5: Log Entry Header
struct VHDX_LOG_ENTRY_HEADER {
	UINT32 	Signature;
	UINT32 	Checksum;
	UINT32 	EntryLength;
	UINT32 	Tail;
	UINT64 	SequenceNumber;
	UINT32 	DescriptorCount;
	UINT32 	Reserved;
	GUID 		LogGuid;
	UINT64 	FlushedFileOffset;
	UINT64 	LastFileOffset;
};

//Structure 6: Log Zero Descriptor
struct VHDX_LOG_ZERO_DESCRIPTOR {
	UINT32 	ZeroSignature;
	UINT32 	Reserved;
	UINT64 	ZeroLength;
	UINT64 	FileOffset;
	UINT64 	SequenceNumber;
};

//Structure 7: Log Data Descriptor
struct VHDX_LOG_DATA_DESCRIPTOR {
	UINT32 	DataSignature;
	UINT32 	TrailingBytes;
	UINT64 	LeadingBytes;
	UINT64 	FileOffset;
	UINT64 	SequenceNumber;
};

//Structure 8: Log Data Sector
struct VHDX_LOG_DATA_SECTOR {
	UINT32 	DataSignature;
	UINT32 	SequenceHigh;
	UINT8 	Data[4084];
	UINT32 	SequenceLow;
};

//Structure 9: BAT Entry
struct VHDX_BAT_ENTRY {
	UINT64 	State:3;
	UINT64 	Reserved:17;
	UINT64 	FileOffsetMB:44;
};

//Structure 10: Metadata Table Header
struct VHDX_METADATA_TABLE_HEADER {
	UINT64 	Signature;
	UINT16 	Reserved;
	UINT16 	EntryCount;
	UINT32 	Reserved2[5];
};

//Structure 11: Metadata Table Entry
struct VHDX_METADATA_TABLE_ENTRY {
	GUID	 	ItemId;
	UINT32 	Offset;
	UINT32 	Length;
	UINT32 	IsUser:1;
	UINT32 	IsVirtualDisk:1;
	UINT32 	IsRequired:1;
	UINT32 	Reserved:29;
	UINT32 	Reserved2;
};

//Structure 12: File Parameters Metadata Item
struct VHDX_FILE_PARAMETERS {
	UINT32 	BlockSize;
	UINT32 	LeaveBlocksAllocated:1;
	UINT32 	HasParent:1;
	UINT32 	Reserved:30;
};

//Structure 13: Virtual Disk Size Metadata Item
struct VHDX_VIRTUAL_DISK_SIZE {
	UINT64 	VirtualDiskSize;
};

//Structure 14: Page 83 Data Metadata Item
struct VHDX_PAGE83_DATA {
	GUID 		Page83Data;
};

//Structure 15: Logical Sector Size Metadata Item
struct VHDX_VIRTUAL_DISK_LOGICAL_SECTOR_SIZE {
	UINT32 	LogicalSectorSize;
};

//Structure 16: Logical Sector Size Metadata Item
struct VHDX_VIRTUAL_DISK_PHYSICAL_SECTOR_SIZE {
	UINT32 	PhysicalSectorSize;
};

//Structure 17: Parent Locator Header
struct VHDX_PARENT_LOCATOR_HEADER {
	GUID 		LocatorType;
	UINT16 	Reserved;
	UINT16 	KeyValueCount;
};

//Structure 18: Parent Locator Entry
struct VHDX_PARENT_LOCATOR_ENTRY {
	UINT32 	KeyOffset;
	UINT32 	ValueOffset;
	UINT16 	KeyLength;
	UINT16 	ValueLength;
};

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

//Structure 1: File Type Identifier

struct VHDX_FILE_IDENTIFIER {

UINT64 Signature;

UINT16 Creator[256];

};

//Structure 2: Header

struct VHDX_HEADER {

UINT32 Signature;

UINT32 Checksum;

UINT64 SequenceNumber;

GUID FileWriteGuid;

GUID DataWriteGuid;

GUID LogGuid;

UINT16 LogVersion;

UINT16 Version;

UINT32 LogLength;

UINT64 LogOffset;

UINT8[502] Reserved;

};

//Structure 3: Region Table Header

struct VHDX_REGION_TABLE_HEADER {

UINT32 Signature;

UINT32 Checksum;

UINT32 EntryCount;

UINT32 Reserved;

};

//Structure 4: Region Table Entry

struct VHDX_REGION_TABLE_ENTRY {

GUID Guid;

UINT64 FileOffset;

UINT32 Length;

UINT32 Required:1;

UINT32 Reserved:31;

};

//Structure 5: Log Entry Header

struct VHDX_LOG_ENTRY_HEADER {

UINT32 Signature;

UINT32 Checksum;

UINT32 EntryLength;

UINT32 Tail;

UINT64 SequenceNumber;

UINT32 DescriptorCount;

UINT32 Reserved;

GUID LogGuid;

UINT64 FlushedFileOffset;

UINT64 LastFileOffset;

};

//Structure 6: Log Zero Descriptor

struct VHDX_LOG_ZERO_DESCRIPTOR {

UINT32 ZeroSignature;

UINT32 Reserved;

UINT64 ZeroLength;

UINT64 FileOffset;

UINT64 SequenceNumber;

};

//Structure 7: Log Data Descriptor

struct VHDX_LOG_DATA_DESCRIPTOR {

UINT32 DataSignature;

UINT32 TrailingBytes;

UINT64 LeadingBytes;

UINT64 FileOffset;

UINT64 SequenceNumber;

};

//Structure 8: Log Data Sector

struct VHDX_LOG_DATA_SECTOR {

UINT32 DataSignature;

UINT32 SequenceHigh;

UINT8 Data[4084];

UINT32 SequenceLow;

};

//Structure 9: BAT Entry

struct VHDX_BAT_ENTRY {

UINT64 State:3;

UINT64 Reserved:17;

UINT64 FileOffsetMB:44;

};

//Structure 10: Metadata Table Header

struct VHDX_METADATA_TABLE_HEADER {

UINT64 Signature;

UINT16 Reserved;

UINT16 EntryCount;

UINT32 Reserved2[5];

};

//Structure 11: Metadata Table Entry

struct VHDX_METADATA_TABLE_ENTRY {

GUID ItemId;

UINT32 Offset;

UINT32 Length;

UINT32 IsUser:1;

UINT32 IsVirtualDisk:1;

UINT32 IsRequired:1;

UINT32 Reserved:29;

UINT32 Reserved2;

};

//Structure 12: File Parameters Metadata Item

struct VHDX_FILE_PARAMETERS {

UINT32 BlockSize;

UINT32 LeaveBlocksAllocated:1;

UINT32 HasParent:1;

UINT32 Reserved:30;

};

//Structure 13: Virtual Disk Size Metadata Item

struct VHDX_VIRTUAL_DISK_SIZE {

UINT64 VirtualDiskSize;

};

//Structure 14: Page 83 Data Metadata Item

struct VHDX_PAGE83_DATA {

GUID Page83Data;

};

//Structure 15: Logical Sector Size Metadata Item

struct VHDX_VIRTUAL_DISK_LOGICAL_SECTOR_SIZE {

UINT32 LogicalSectorSize;

};

//Structure 16: Logical Sector Size Metadata Item

struct VHDX_VIRTUAL_DISK_PHYSICAL_SECTOR_SIZE {

UINT32 PhysicalSectorSize;

};

//Structure 17: Parent Locator Header

struct VHDX_PARENT_LOCATOR_HEADER {

GUID LocatorType;

UINT16 Reserved;

UINT16 KeyValueCount;

};

//Structure 18: Parent Locator Entry

struct VHDX_PARENT_LOCATOR_ENTRY {

UINT32 KeyOffset;

UINT32 ValueOffset;

UINT16 KeyLength;

UINT16 ValueLength;

};

数据恢复实验室 Data Recovery Laboratory

力求做到最好的数据恢复效果，降低数据丢失带来的损失，为您的数据安全保驾护航。

标签归档：虚拟磁盘

VirtualBox虚拟机磁盘结构-WinHex模板

VHDX 虚拟磁盘格式结构