Issue with initialization of DiskDescriptor.xml (Parallels HDD virtual disk implementation)
Closed this issue · 1 comments
Issue with initialization of DiskDescriptor.xml (Parallels HDD virtual disk implementation)
Observed behaviour
The following command is executed on a Parallels HDD file (with the DiskDescriptor.xml in the same folder):
target-shell data.hdd
While trying to mount a Parallels HDD file (.hdd) the DiskDescriptor.xml is not detected correctly and throws the following error:
[...]
File: "/usr/local/lib/python3.10/dist-packages/dissect/hypervisor/disk/hdd.py", line 40, in __init__
raise ValueError: Invalid Parallels HDD path: data.hdd (missing DiskDescriptor.xml)
[...]
Adding a print statement to the specific file after the descriptor_path
as specified below seems to initialise descriptor_path
:
[...]
descriptor_path = path.joinpath("DiskDescriptor.xml")
print(descriptor_path)
[...]
And the following output is observed afterwards:
XXXX-XX-XXTXX:XX:XX.XXXXXXZ [warning ] <Target data.hdd>: Can't identify volume system, adding as raw volume instead: <RawContainer size=XXXXXX vs=None> [dissect.target.target]
[...]
data.hdd />
Thanks for reporting this! I've loosened the restriction on the parent directory of a .hdd
file. It required the parent directory to also have a .hdd
extension, as is the case when stored by Parallels. However this is of course not always the case when dealing with evidence.
As a workaround, you can put all the files you have (DiskDescriptor.xml
, data.hdd
, any others) in a new directory with the .hdd
extension (e.g. mydisk.hdd
). When you then use mydisk.hdd
as target, it should work as expected.