fox-it/dissect.hypervisor

Issue with initialization of DiskDescriptor.xml (Parallels HDD virtual disk implementation)

Closed this issue · 1 comments

Issue with initialization of DiskDescriptor.xml (Parallels HDD virtual disk implementation)

Observed behaviour

The following command is executed on a Parallels HDD file (with the DiskDescriptor.xml in the same folder):

target-shell data.hdd

While trying to mount a Parallels HDD file (.hdd) the DiskDescriptor.xml is not detected correctly and throws the following error:

[...]
File: "/usr/local/lib/python3.10/dist-packages/dissect/hypervisor/disk/hdd.py", line 40, in __init__
  raise ValueError: Invalid Parallels HDD path: data.hdd (missing DiskDescriptor.xml)
[...]

descriptor_path = path.joinpath("DiskDescriptor.xml")

Adding a print statement to the specific file after the descriptor_path as specified below seems to initialise descriptor_path:

[...]
descriptor_path = path.joinpath("DiskDescriptor.xml") 
print(descriptor_path)
[...]

And the following output is observed afterwards:

XXXX-XX-XXTXX:XX:XX.XXXXXXZ [warning   ] <Target data.hdd>: Can't identify volume system, adding as raw volume instead: <RawContainer size=XXXXXX vs=None> [dissect.target.target]
[...]
data.hdd />

Thanks for reporting this! I've loosened the restriction on the parent directory of a .hdd file. It required the parent directory to also have a .hdd extension, as is the case when stored by Parallels. However this is of course not always the case when dealing with evidence.

As a workaround, you can put all the files you have (DiskDescriptor.xml, data.hdd, any others) in a new directory with the .hdd extension (e.g. mydisk.hdd). When you then use mydisk.hdd as target, it should work as expected.