{"id":51015079,"url":"https://github.com/securityronin/vhdx-core","last_synced_at":"2026-06-21T09:02:44.508Z","repository":{"id":359347021,"uuid":"1245653862","full_name":"SecurityRonin/vhdx-core","owner":"SecurityRonin","description":"Pure-Rust VHDX (Hyper-V) virtual-disk container library — reader (writer planned), published as the vhdx-core crate","archived":false,"fork":false,"pushed_at":"2026-06-08T01:27:04.000Z","size":123,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-08T03:18:55.351Z","etag":null,"topics":["container","dfir","digital-forensics","disk-image","forensics","hyper-v","rust","vhdx","virtual-disk","windows"],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SecurityRonin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-21T12:30:30.000Z","updated_at":"2026-06-08T01:27:07.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/SecurityRonin/vhdx-core","commit_stats":null,"previous_names":["securityronin/vhdx","securityronin/vhdx-core"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/SecurityRonin/vhdx-core","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fvhdx-core","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fvhdx-core/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fvhdx-core/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fvhdx-core/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SecurityRonin","download_url":"https://codeload.github.com/SecurityRonin/vhdx-core/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fvhdx-core/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34603647,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-21T02:00:05.568Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["container","dfir","digital-forensics","disk-image","forensics","hyper-v","rust","vhdx","virtual-disk","windows"],"created_at":"2026-06-21T09:02:39.127Z","updated_at":"2026-06-21T09:02:44.493Z","avatar_url":"https://github.com/SecurityRonin.png","language":"Rust","funding_links":["https://github.com/sponsors/h4x0r"],"categories":[],"sub_categories":[],"readme":"[![Crates.io](https://img.shields.io/crates/v/vhdx-core.svg)](https://crates.io/crates/vhdx-core)\n[![Docs.rs](https://img.shields.io/docsrs/vhdx-core)](https://docs.rs/vhdx-core)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)\n[![CI](https://github.com/SecurityRonin/vhdx-core/actions/workflows/ci.yml/badge.svg)](https://github.com/SecurityRonin/vhdx-core/actions/workflows/ci.yml)\n[![Sponsor](https://img.shields.io/badge/sponsor-h4x0r-ea4aaa?logo=github-sponsors)](https://github.com/sponsors/h4x0r)\n\n**Pure-Rust VHDX (Hyper-V) virtual-disk container library (reader; writer planned) — dynamic, fixed, differencing, and dirty-log recovery.**\n\nDecodes the Microsoft VHDX container format (Hyper-V, Windows 8+, WSL2, Azure) and exposes a `Read + Seek` interface over the virtual sector stream. Replays dirty logs automatically on open and supports differencing-disk parent chains — zero unsafe code, no C bindings, no external tools required.\n\n```toml\n[dependencies]\nvhdx-core = \"0.2\"   # published as vhdx-core, imported as `vhdx`\n```\n\n---\n\n## Usage\n\n### Open a VHDX and read sectors\n\n```rust\nuse vhdx::VhdxReader;\nuse std::io::{Read, Seek, SeekFrom};\n\nlet mut reader = VhdxReader::open(\"disk.vhdx\")?;\n\nprintln!(\"Virtual disk size: {} bytes\", reader.virtual_disk_size());\nprintln!(\"Logical sector size: {} bytes\", reader.logical_sector_size());\n\n// Read the first sector\nlet mut sector = vec![0u8; reader.logical_sector_size() as usize];\nreader.seek(SeekFrom::Start(0))?;\nreader.read_exact(\u0026mut sector)?;\n```\n\n### Pass to a filesystem crate\n\n`VhdxReader` implements `Read + Seek`, so it drops directly into any crate that accepts a reader:\n\n```rust\nuse vhdx::VhdxReader;\n\nlet reader = VhdxReader::open(\"disk.vhdx\")?;\n// e.g. ext4fs_forensic::Filesystem::open(reader)?;\n```\n\n### Read from an in-memory buffer\n\n```rust\nuse vhdx::VhdxReader;\n\nlet data: Vec\u003cu8\u003e = std::fs::read(\"disk.vhdx\")?;\nlet reader = VhdxReader::from_bytes(data)?;\n```\n\n### Open a differencing (child) disk with its parent\n\n```rust\nuse vhdx::VhdxReader;\n\nlet parent = VhdxReader::from_bytes(std::fs::read(\"base.vhdx\")?)?;\nlet reader = VhdxReader::from_bytes_with_parent(std::fs::read(\"child.vhdx\")?, parent)?;\n// Reads absent blocks in the child are transparently served from parent.\n```\n\n---\n\n## CLI\n\nThe `vhdx-cli` crate (included in this workspace) provides a `vhdx info` command:\n\n```\n$ vhdx info disk.vhdx\nFile:              disk.vhdx\nFormat:            VHDX v1 (dynamic)\nVirtual disk size: 16,777,216 bytes (16.00 MiB)\nLogical sectors:   512 bytes\n```\n\n---\n\n## Supported formats\n\n| Format | Supported |\n|--------|:---------:|\n| VHDX Version 1 (Windows 8 / Server 2012+) | ✓ |\n| Dynamic disks (sparse, BAT-addressed) | ✓ |\n| Fixed disks (pre-allocated) | ✓ |\n| Differencing disks (single-level parent chain) | ✓ |\n| Log replay (dirty-log recovery) | ✓ |\n\nRead-only. Differencing disks require the parent image to be supplied via `VhdxReader::from_bytes_with_parent`. Log replay is applied automatically on open when the active header carries a non-zero LogGuid.\n\n---\n\n## Related crates\n\n### Container readers\n\n| Crate | Format | Notes |\n|-------|--------|-------|\n| [`ewf`](https://github.com/SecurityRonin/ewf) | E01 / EWF / Ex01 | Dominant professional forensic acquisition format |\n| [`aff4`](https://github.com/SecurityRonin/aff4) | AFF4 v1 | Evimetry / aff4-imager forensic disk images with Map streams |\n| [`vmdk`](https://github.com/SecurityRonin/vmdk) | VMware VMDK | Monolithic sparse disk images from VMware Workstation / ESXi |\n| [`vhd`](https://github.com/SecurityRonin/vhd) | Legacy VHD | Virtual PC / Hyper-V Generation-1 fixed and dynamic disk images |\n| [`qcow2`](https://github.com/SecurityRonin/qcow2) | QCOW2 v2/v3 | QEMU / KVM / libvirt disk images |\n| [`ufed`](https://github.com/SecurityRonin/ufed) | Cellebrite UFED | Physical mobile device dumps with UFD XML segment mapping |\n| [`dd`](https://github.com/SecurityRonin/dd) | Raw / flat / gz | dd, dcfldd, and gzip-wrapped raw images |\n| [`iso9660-forensic`](https://github.com/SecurityRonin/iso9660-forensic) | ISO 9660 | Optical disc images: multi-session, UDF bridge, Rock Ridge, Joliet, El Torito |\n| [`dmg`](https://github.com/SecurityRonin/dmg) | Apple DMG / UDIF | macOS disk images with koly trailer, mish block tables, zlib decompression |\n| [`dar`](https://github.com/SecurityRonin/dar) | DAR archive | Disk ARchiver archives with catalog index and CRC32 validation |\n\n### Forensic analysers\n\n| Crate | Format | Notes |\n|-------|--------|-------|\n| [`vhdx-forensic`](https://github.com/SecurityRonin/vhdx-forensic) | VHDX | Forensic integrity analyser and in-memory repair tool built on this crate |\n| [`ewf-forensic`](https://github.com/SecurityRonin/ewf-forensic) | E01 | Structural integrity audit, Adler-32 / MD5 hash verification, and in-memory repair |\n\n---\n\n[Privacy Policy](https://securityronin.github.io/vhdx-core/privacy/) · [Terms of Service](https://securityronin.github.io/vhdx-core/terms/) · © 2026 Security Ronin Ltd\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fvhdx-core","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecurityronin%2Fvhdx-core","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fvhdx-core/lists"}