How to Extract Content from VMDK Files

Sometimes, you’ll find yourself needing access to the contents of a virtual machine’s virtual disk (VMDK), perhaps to retrieve data due to a VM biting the dust. Maybe, a recent update is preventing you from booting the guest OS and you have no backups to rely on. It happens!

In this post, I’ll go over 4 different ways you can use to extract content from VMDK files.

Before we move on, just a reminder that a VMDK is comprised of 2 parts; the descriptor and the flat file. The descriptor file contains disk information such as its geometry, ids and virtual hardware version. It is, in fact, nothing but a text file viewable in any text editor. The flat file is where the actual data lives. For further details why not have a look at The Anatomy of a VMware Virtual Machine.

Viewing a VMDK descriptor file in a text editor

Note: The descriptor file is not listed under datastore browser but it can be viewed from the ESXi shell while SSH’ed using a client such as putty or directly from the console.

For this post, I’ve used the VMDKs of both Windows and Linux VMs copying the descriptor and flat files to a folder on my Windows PC, given that some methods covered require both files. Note that you can also use tools like VMFS Recovery to remotely mount VMDKs without having to download them locally.

Method 1 – Attaching a VMDK to an existing VM

As trivial as it may sound, an easy way to access the contents of a VMDK, is simply to attach it to another functional VM. It does not really matter whether the VM is hosted on ESXi, Workstation or some other hypervisor.

The following video shows how to attach the VMDK file of a Windows 7 VM hosted on ESXi 6.5 to a VM running under VMware Workstation Pro just to demonstrate cross-hypervisor functionality.

:0:

TIP: As shown in the video, when using Workstation, you may run into compatibility issues that could prevent you from attaching the VMDK to the VM. The issue is usually related to an unsupported virtual hardware version. This is easily fixed by changing the hardware version value in the descriptor file, to that supported by VMware Workstation. To do this, have a look at the descriptor file of any VM’s VMDK running under Workstation. This will give you the supported hardware version or else refer to the online documentation.

Inspecting or changing the hardware version for a VMDK

Method 2 – Using 7-Zip

7-Zip is probably the most popular compression tool out there not in the least because it’s freely available for Windows, Linux and other operating systems. It will pretty much extract any type of archive you throw at it.

This is all good news since it will happily open VMDKs without even needing the descriptor file. To do this, just right-click on the VMDK flat file and select Open Archive to copy the VMDK contents to a folder of your choosing. Alternatively, extract the entire disk contents using the Extract to folder functionality. The method works for VMDKs previously attached to either Windows or Linux.

How to open VMDK file as an archive using 7-Zip

Using 7-Zip to copy the contents of a VMDK to a Windows folder

Method 3 – VMware Workstation Player

If you have VMware Workstation Player or PRO installed, you will be able to mount VMDK directly as volumes under Windows. For this method to work, you must put the descriptor and flat files in the same folder. The VMDK can then be mounted as a Read-Only or a Read-Write volume by right-clicking on it in Windows Explorer, choosing one of two options.

This works for both Windows and Linux VMDKs, however, Windows cannot natively read Linux file systems, so you’ll need to use some third-party tool like Explore2fs or Ext2Read that does.

Mounting a VMware VMDK file in Windows using Workstation functionality embedded in Windows Explorer

A Windows VMDK is easily mounted and mapped as a drive using VMware Workstation’s functionality

When you’re done using the VMDK, dismount the volume from Explorer by right-clicking and selecting Disconnect Virtual Disk.

Unmounting a VMDK when done using it

Method 4 – Linux Reader

Linux Reader is a free tool distributed by DiskInternals. It is used to mount, or provide access, to a number of file systems configured on Linux machines. These include Ext2/3/4, HFS and ReiserFS. It is also capable of mounting VMDKs right out of the box, which is the one feature we’re after.

You can download Linux Reader from here. Once you’ve installed it, select Mount Image option from the Drives menu. Then, select Containers -> VMware virtual disks and press Next.

Mounting VMDK disks using Linux Reader from DiskInternals

Next, navigate to the folder containing the VMDK files and press OK to select it. On the screen that follows, check the boxes next to the VMDKs you want to be mounted and click on Mount. As per the next screenshot, I selected two VMDKs; an ext4 formatted disk from a Centos VM and an NTFS one from a Windows VM.

Selecting multiple VMDKs to mount as disks in Linux Reader

The software will first scan for Raid Arrays. The VMDK files previously selected are then mounted and conveniently highlighted in red as shown next.

Mounted VMDKs are highlighted in red

Clicking on a mounted volume will give you access to the drive’s contents. These can be saved by right-clicking on the file selection and hitting Save. Alternatively, use CTRL-A to select all the content and click on the Save icon to export everything to a folder of your choice.

Saving and exporting content from a VMDK to an external location

Conclusion

While researching this post, I came across a few other methods which I still have to look into. These include utilities such as OSFMount and other ISO and imaging tools that can natively process VMDKs. VMware also provides a command line tool called vmware-mount which used to be included with the VDDK SDK. The tool is no longer included but you can still obtain it by downloading VDDK 5.1 or earlier versions. I also came across the VMware Disk Mount Utility which failed to install since, apparently, it is not supported on 64-bit operating systems because of an unsigned 32-bit driver.

All said and done, the methods outlined today should suffice in allowing you to inspect the content of a VMDK format. In my opinion, using 7-ZIP – or any other compression tool with identical capabilities – is by far the easiest method.

To remain in theme, have a look at how to work with VMDKs attached to Linux virtual machines.