Linux Virtualization

analyze / mount virtual images (VDI) from VirtualBox

Sometimes you would like to look into a virtual image (VDI file) of VirtualBox without starting the VM. One solution could be to setup another VM and attach the VDI to the helper VM. An easier solution would be the analysis with standard Linux tools.

You can use the QEMU tools to mount your virtual disks. First you have to install these tools if not already present (here for Ubuntu):

apt install qemu-utils

Then you should create a snapshot of your virtual image, so that modifications are not written back to your image. If you need to manipulate a virtual image you can skip this step.

qemu-img create -f qcow2 -b VIRTUALDISK.vdi snapshot.qcow2

Then you will use qemu-nbd to create a block device of your virtual image. To use qemu-nbd you need to have to load the kernel module nbd.

sudo modprobe nbd
lsmod | grep -Fi nbd 

The last command should output something like:

nbd                    40960  0

Then you will connect the blockdevice /dev/nbd0 with your virtual image:

qemu-nbd -c /dev/nbd0 snapshot.qcow2

Then you can use it like every other disc. For example with fdisk or lsblk or you can mount a partition of the virtual image.

fdisk -lu /dev/nbd0
lsblk -i /dev/nbd0
mount /dev/nbd0p1 /mnt

After you finished your analysis, you have to disconnect the virtual image:

qemu-nbd -d /dev/nbd0

If you created a snapshot you can easily remove this file.