README.md


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122


vm-inspector
A sample tool for inspecting a disk image file, e.g. vmdk, vdi, qcow, etc., to determine which operating system and applications it contains.
Usage
To inspect a disk image file:
python3 inspect.py foo.vmdk


or
./inspect.py foo.vmdk


CLI options
./inspect.py --help


usage: inspect.py [-h] [-b {libvmdk,nbdfuse}] [-v] image

Tool for inspecting a disk image file to determine which operating
system and applications it contains.

positional arguments:
  image                 disk image file to inspect

optional arguments:
  -h, --help            show this help message and exit
  -b {libvmdk,nbdfuse}, --backend {libvmdk,nbdfuse}
                        used backend for mounting disk image files in
                        the local filesystem (default: nbdfuse)
  -v, --verbose         print debug messages


Requirements


Python >= 3.8


Debian 11 Bullseye (recommended) or Ubuntu 20.04


General Packages
sudo apt install git python3 python3-pip python-is-python3


lklfuse

$ sudo apt install build-essential flex bison bc libfuse-dev libarchive-dev xfsprogs
$ git clone https://github.com/lkl/linux.git --depth=1
$ cd linux
$ echo "CONFIG_NTFS_FS=y" >> arch/lkl/configs/defconfig
$ make -j -C tools/lkl
$ sudo cp tools/lkl/lklfuse /usr/local/bin


nbdfuse + qemu-nbd (qcow2, vdi, vmdk, etc.) or libvmdk >= 20210807 (vmdk only)

$ sudo apt install qemu-utils nbdfuse


$ sudo apt install build-essential libfuse-dev
$ wget https://github.com/libyal/libvmdk/releases/download20210807/libvmdk-alpha-20210807.tar.gz
$ tar xfv libvmdk-alpha-20210807.tar.gz
$ cd libvmdk-20210807/
$ ./configure
$ make -j
$ sudo make install
$ sudo ldconfig


libvslvm >= 20210807 (Library and tools to access the Linux Logical Volume Manager (LVM) volume system format )

$ sudo apt install build-essential libfuse-dev
$ wget https://github.com/libyal/libvslvm/releases/download20210807/libvslvm-experimental-20210807.tar.gz
$ tar xfv libvslvm-experimental-20210807.tar.gz
$ cd libvslvm-20210807/
$ ./configure
$ make -j
$ sudo make install
$ sudo ldconfig


pyparted (Python bindings for GNU parted )

$ sudo apt install python3-dev libparted-dev pkg-config
$ pip3 install pyparted

For Ubuntu 20.04 an older version is needed
$ pip3 install pyparted==3.11.7


python-registry (Pure Python parser for Windows Registry hives)

$ pip3 install python-registry


python3-rpm >= 4.16.1.3

$ sudo apt install build-essential python3-dev zlib1g-dev libgcrypt20-dev libmagic-dev libpopt-dev libsqlite3-dev libarchive-dev
$ wget https://ftp.osuosl.org/pub/rpm/releases/rpm-4.16.x/rpm-4.16.1.3.tar.bz2
$ tar xfv rpm-4.16.1.3.tar.bz2
$ cd rpm-4.16.1.3/
$ ./autogen.sh --enable-python --enable-bdb=no --enable-bdb-ro --enable-sqlite=yes --enable-ndb --without-lua --disable-plugins
$ make -j
$ sudo make install
$ sudo ldconfig
$ cd python && sudo python3 setup.py install