Virtualization Disk image

a hard disk image interpreted virtual machine monitor system hard disk drive. administrators , software developers administer them through offline operations using built-in or third-party tools. in terms of naming, hard disk image virtual machine monitor has specific file type extension, e.g., .vmdk vmware vmdk, .vhd xen , microsoft hyper-v, .vdi oracle vm virtualbox, etc..

hard drive imaging used in several major application areas:

forensic imaging or acquisition process entire drive contents imaged file , checksum values calculated verify integrity (in court cases) of image file (often referred hash value ). forensic images acquired use of software tools. (some hardware cloning tools have added forensic functionality.)
drive cloning, mentioned, typically used replicate contents of hard drive use in system. can typically done software-only programs typically requires cloning of file structure , files themselves.
data recovery imaging (like forensic imaging) process of imaging every single sector on source drive medium required files can retrieved. in data recovery situations, 1 cannot rely on integrity of file structure , therefore complete sector copy mandatory (also similar forensic imaging). similarities forensic imaging end there though. forensic images typically acquired using software tools such encase , ftk. however, forensic imaging software tools have limited ability deal drives have hard errors (which case in data recovery , why drive submitted recovery in first place).


data recovery imaging must have ability pre-configure drives disabling attributes (such smart , g-list re-mapping) , ability work unstable drives (drive instability/read instability can caused minute mechanical wear , other issues). data recovery imaging must have ability read data bad sectors. read instability major factor when working drives in operating systems such windows. typical operating system limited in ability deal drives take long time read. these reasons, software relies on bios , operating system communicate hard drive unsuccessful in data recovery imaging; separate hardware control of source hard drive required achieve full spectrum of data recovery imaging. because operating system (through bios) has set of protocols or rules communication drive cannot violated (such when hard drive detects bad sector). hard drive s protocols may not allow bad data propagated through operating system; firmware on drive may compensate rereading sectors until checksums, crcs, or eccs pass, or use ecc data recreate damaged data.
data recovery images may or may not make use of type of image file. typically, data recovery image performed drive drive , therefore no image file required.

there 2 schemes predominant across virtual machine monitor implementations:

the virtual disk implemented either split on collection of flat files, typically each 1 2gb in size, collectively called split flat file, or single, large monolithic flat file. pre-allocated storage scheme referred thick provisioning scheme.

the virtual disk can again implemented using split or monolithic files, except storage allocated on demand. several virtual machine monitor implementations initialize storage zeros before providing virtual machine in operation. dynamic growth storage scheme referred thin provisioning scheme.

there 2 modes in raw disk can mapped use virtual machine:

virtual mode
the mapped disk presented if logical volume, or virtual disk file, guest operating system , real hardware characteristics hidden. in mode, file locking provides data protection through isolation concurrent updates; copy on write operation enables snapshots. virtual mode offers portability across storage hardware because presents consistent behavior virtual disk file.
physical mode
in mode, called pass through mode, virtual machine monitor bypasses i/o virtualization layer , passes i/o commands directly device. physical characteristics of underlying hardware exposed guest operating system. there no file locking provide data protection.




^ vmware esx configuration guide (pdf). vmware, inc. 18 may 2010. retrieved 10 december 2010.