{"id":19170572,"url":"https://github.com/ccob/volumiser","last_synced_at":"2025-04-09T06:10:56.288Z","repository":{"id":150790887,"uuid":"563560648","full_name":"CCob/Volumiser","owner":"CCob","description":null,"archived":false,"fork":false,"pushed_at":"2024-09-12T14:26:42.000Z","size":845,"stargazers_count":376,"open_issues_count":2,"forks_count":42,"subscribers_count":9,"default_branch":"master","last_synced_at":"2025-04-02T02:11:39.729Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CCob.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-11-08T21:38:56.000Z","updated_at":"2025-03-31T15:06:47.000Z","dependencies_parsed_at":"2024-12-16T06:02:15.753Z","dependency_job_id":"07310497-6438-41a0-960a-a3be83866ec4","html_url":"https://github.com/CCob/Volumiser","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CCob%2FVolumiser","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CCob%2FVolumiser/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CCob%2FVolumiser/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CCob%2FVolumiser/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CCob","download_url":"https://codeload.github.com/CCob/Volumiser/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247987285,"owners_count":21028895,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-09T09:54:29.477Z","updated_at":"2025-04-09T06:10:56.266Z","avatar_url":"https://github.com/CCob.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Volumiser\n\n## Introduction\n\nVolumiser is a command line tool and interactive console GUI for listing, browsing and extracting files from common virtual machine hard disk image formats.\n\nThe tool was written to combat a regular problem where massive 100G+ disk images are often hard to work with or exfiltrate when performing red team operations.  Whilst the tool was created for offensive operations, the tool also has benefits outside of it's original intended purpose.\n\n![Volumiser Interactive GUI](Volumiser.gif)\n\nVolumiser would not be possible without the brilliant [DiscUtils](https://github.com/DiscUtils/DiscUtils) project that does most of the heavy lifting parsing volumes and file systems within the virtual disks.  Whilst the EBS volume support is a feature added as part of volumiser, this also leverages this excellent library to add this particular disk image format.\n\nVolumiser supports the following disk image formats:\n\n* Amazon EBS Snapshots\n* Direct Raw Disk (a la NinjaCopy)\n* VHDX\n* VMDK\n* VHD\n* VHDX\n\n\nalong with the following file systems:\n\n* NTFS\n* FAT\n* ext3\n* ext4\n\n## Usage\n\n### Interactive Mode\n\nInteractive mode is started by supplying the `--image` argument followed by a local file or EBS snapshot id\n\n**EBS Snapshot Example**\n\nEBS snapshot can be loaded via the custom EBS protocol which levereges the EBS direct API for seeking and reading sectors from an EBS volume.  By default the AWS CLI credentials file is used for authentication, various AWS options can also be specified using the `--awsprofile`, `--awskey`, `--awssecret` and `--awsregion` arguments \n\n```powershell\nVolumiser.exe --image \"ebs://snap-12345675c8173707d\"\n```\n\n**Direct Raw Disk Example**\n\nProviding you have administrator rights, local raw disk volumes can be accessed via the `\\\\.\\PhysicalDriveX` image specifier or `\\\\.\\C:`.  When using the `PhysicalDrive` method, this will parse all volumes contained on the entire disk.  In situations where a volume is encrypted with BitLocker, you can switch to the drive letter method, this will access the single volume exposed by the drive letter which will automatically be decrypted by Windows when the volume sectors are read.\n\n*Reading all the volumes present on the first physical drive attached to the host*\n```powershell\nVolumiser.exe --image \"\\\\.\\PhysicalDrive0\"\n```\n\n\n*Reading the single volume attached to the drive letter C: (use this method for BitLocker'd volumes)*\n```powershell\nVolumiser.exe --image \"\\\\.\\C:\"\n```\n\n**Local Image File Example**\n\nDisk images accessible via the file system can also be specified, including files from network shares\n\n```powershell\nVolumiser.exe --image \"c:\\Virtual Machines\\Domain Controller.vhdx\"\n```\n\n### C2 Mode\n\nIn the event that the interactive console cannot be used, Volumiser supports listing volumes and file systems directly via the `--command` and `--path` arguments.\n\n**Listing Volumes**\n\nVolumes contained within a disk image can be listed using the volumes command\n\n```\nVolumiser.exe --image \"c:\\Virtual Machines\\Domain Controller.vhdx\" --command volumes\n[+] Opened disk image, Size: 127GB\n        Volume ID: VLG{2d02912f-a98f-4074-aaee-c3444d01b43a}, Size: 100 MB, Type: Microsoft FAT\n        Volume ID: VLG{22956ef6-5b59-41f7-8751-8331c6183062}, Size: 16 MB, Type: Unknown\n        Volume ID: VLG{166c0197-909e-419d-a431-2d9b9df4d1fe}, Size: 129376 MB, Type: Microsoft NTFS\n        Volume ID: VLG{bdd5d39c-a214-4ac2-a6b9-2477fe02ffc1}, Size: 553 MB, Type: Microsoft NTFS\n```\n\n**Listing File System**\n\nOnce the volumes have been discovered, the file system for each volume can be listed\n\n```\nVolumiser.exe --image \"c:\\Virtual Machines\\Domain Controller.vhdx\" --command ls --path \"VLG{166c0197-909e-419d-a431-2d9b9df4d1fe}:\\Windows\"\n[+] Opened disk image, Size: 127GB\n[+] Opened volume with ID VLG{166c0197-909e-419d-a431-2d9b9df4d1fe}\n17/10/2022 18:51:29  DIR             appcompat\n17/10/2022 19:52:06  DIR             apppatch\n17/10/2022 18:59:17  DIR             AppReadiness\n17/10/2022 19:53:57  DIR             assembly\n14/05/2022 09:26:58  DIR             bcastdvr\n14/05/2022 09:42:31  DIR             Boot\n14/05/2022 09:26:54  DIR             Branding\n14/05/2022 11:35:21  DIR             BrowserCor\n...\n```\n\n**\"Downloading\" Files**\n\nFiles can be \"downloaded\" to your local machine using the download command\n\n```\nVolumiser.exe --image \"c:\\Virtual Machines\\Domain Controller.vhdx\" --command download --path \"VLG{166c0197-909e-419d-a431-2d9b9df4d1fe}:\\Windows\\system32\\config\\SYSTEM\"\n[+] Opened disk image, Size: 127GB\n[+] Opened volume with ID VLG{166c0197-909e-419d-a431-2d9b9df4d1fe}\n[+] Opened file with path \\Windows\\System32\\config\\SYSTEM for with size: 12058624\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fccob%2Fvolumiser","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fccob%2Fvolumiser","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fccob%2Fvolumiser/lists"}