You are here:Home»KB»PC»Virtual Machines»Disk Image Handling
Friday, 18 July 2025 13:11

Disk Image Handling

Written by

Glossary

  • P2V
    • (Physical-to-Virtual) conversion
    • P2V converts a physical server's operating system, applications, and data into a virtual machine format (like VMDK).
  • V2V
    • (Virtual-to-Virtual) conversion
    • the process of migrating a virtual machine (VM) from one virtualization platform to another.
  • Fixed Disk / "Thick" Provisions
    • These disk images are a set size and are never changed. They are roughly the size of the disk defined in the image.
  • Dynamic Disk / Growable / "Thin" Provisioned / "Sparse" Provisioned
    • the disk image file size can change and is not directly related to the size of the defined virtual disk it holds.
  • OVA/OVF
    • These are not disk images, but a standard to allow moving of virtual machines between platforms.
    • Deploy and Export OVF and OVA Templates
      • You can export virtual machines, virtual appliances, and vApps in Open Virtual Format (OVF) and Open Virtual Appliance (OVA). You can then deploy the OVF or OVA template in the same environment or in a different environment.
    • How To Convert Virtual Machines Between VirtualBox and VMware
      • Migrating to another virtual machine program can be intimidating.
      • If you use an ova extension, then all of the files will be combined into one Open Virtualization Format Archive.
      • If you use an ovf extensions, several files will be written separately.
  • Super Floppy
    • This is the term given to a type of USB formating where it has the following features:
      • No MBR
      • No Partition Table
      • 1 Partition that takes the whole of the drive
    • The term "super floppy" can be a bit ambiguous, but generally, when people refer to a "super floppy" in the context of USB drives, they often mean a removable drive (like a USB flash drive) that does not have partitions, behaving more like a traditional floppy disk. Some older disk management utilities, like Acronis Disk Director, might label such drives as "Super Floppy."
  • Boot Sector
  • Master Boot Record (MBR)
    • The MBR is physically the first sector of a data medium (e.g. hard drive or USB stick), which is used by computers for the booting, or start-up process. The computer must be equipped with a BIOS and a x86 operating system.
    • The searches for the active partition and then load the VBR
    • The MBR code is OS specific.
    • This is placed in the boot sector of a drive
    • Volume boot record - Wikipedia
      • A master boot record (MBR) is a type of boot sector in the first block of partitioned computer mass storage devices like fixed disks or removable drives intended for use with IBM PC-compatible systems and beyond. The concept of MBRs was publicly introduced in 1983 with PC DOS 2.0.
      • The MBR holds the information on how the disc's sectors (A.K.A. "blocks") are divided into partitions, each partition notionally containing a file system.
      • The MBR also contains executable code to function as a loader for the installed operating system—usually by passing control over to the loader's second stage, or in conjunction with each partition's volume boot record (VBR). This MBR code is usually referred to as a boot loader.
    • MBR (Master Boot Record) explained - IONOS UK - The master boot record is a vital piece of code for many PCs to start up. But how does it work, how is it structured and how can it be repaired if necessary?
  • Volume Boot Record (VBR)
    • This is where Windows/OS start to load.
    • The VBR is a file with a specific file name in a specific location.
    • The VBR code is OS specific.
    • The VBR for Windows is a file in the root called: BOOTMGR
    • Volume boot record - Wikipedia
      • A volume boot record (VBR) (also known as a volume boot sector, a partition boot record or a partition boot sector) is a type of boot sector introduced by the IBM Personal Computer. 
      • The code in volume boot records is invoked either directly by the machine's firmware or indirectly by code in the master boot record or a boot manager. Code in the MBR and VBR is in essence loaded the same way.
  • Windows Boot Manager
    • Windows Boot Manager - Wikipedia
      • The Windows Boot Manager (BOOTMGR) is the bootloader provided by Microsoft for Windows NT versions starting with Windows Vista and Windows Server 2008. It is the first program launched by the BIOS or UEFI of the computer and is responsible for loading the rest of Windows. It replaced the NTLDR present in older versions of Windows.
      • The boot sector or UEFI loads the Windows Boot Manager (a file named BOOTMGR on either the system or the boot partition), accesses the Boot Configuration Data store and uses the information to load the operating system through winload.exe or winresume.exe on BIOS systems, and winload.efi and winresume.efi on UEFI systems.
      • On system with BIOS firmware, the BIOS invokes MBR boot code from a hard disk drive at startup. The MBR boot code and the VBR boot code are OS-specific. In Microsoft Windows, the MBR boot code tries to find an active partition (the MBR is only 512 bytes), then executes the VBR boot code of an active partition. The VBR boot code tries to find and execute the bootmgr file from an active partition.[3]
      • On systems with UEFI firmware, UEFI invokes bootmgfw.efi from an EFI system partition at startup, starting the Windows Boot Manager.
  • Operating System Boot Loader.

UEFI / MBR Boot Procedure

  • Windows MBR Boot Procedure
    • MBR is loaded into RAM by the firmware.
    • MBR searches for an active partition
    • MBR loads the Windows Boot Manager (BOOTMGR / VBR) from the active paritition.
    • Windows Boot Manager now loads the Windows Boot loader from one of these locations: 
      \windows\system32\winload.exe
\windows\system32\boot\winload.exe
    • Windows now loads
  • Windows EFI Boot Procedure
    • UEFI invokes the Windows Boot Manager from an EFI system partition (ESP) at startup, 
      \EFI\Microsoft\Boot\bootmgfw.efi
    • A user can make an OS selection now, or the default OS is loaded. These settings are defined in the BCD.
    • Windows Boot Manager now loads the Windows Boot loader from one of these locations. 
      \windows\system32\winload.efi
\windows\system32\boot\winload.efi
    • Windows now loads

Links

Image Formats

  • VHD (deprecated)
    • (Microsoft Virtual PC Virtual Hard Disk)
    • Azure (requires fixed size), Virtual PC, 
    • Developed by Microsoft 
    • Does Azure use VHD or VHDX? - Darwin's Data - Azure supports both VHD and VHDX disk formats for virtual machine disks. The choice between VHD and VHDX depends on the specific scenario and requirements.
    • VHD should not be used for new systems.
    • What is a VHD File? (Unpacking Virtual Hard Disk Mysteries) - Discover how Virtual Hard Disk (VHD) files revolutionize computing by simplifying management of multiple operating systems and enhancing efficiency.
  • VHDX
  • VMDK
    • (VMware Virtual Disk File)
    • VMware and ESXi
  • VDI
    • (VirtualBox Virtual Disk File)
    • VirtualBox
  • QCOW (deprecated)
    • KVM type Virtual Machines (old format, deprecated)
  • QCOW2
    • KVM type Virtual Machines
  • HDD,HDS
    • (Parallels Desktop Virtual Disk File)
    • Parallels
  • DD
    • These are created by the Linux command dd.
    • This is a binary blog, made by copying the RAW bits, and therefore is file system agnostic.
  • IMG
    • (Disk or Partition Image File)
    • This binary blog, made by copying the RAW bits, and therefore is file system agnostic.
    • IMG (file format) - Wikipedia
      • The .img file extension was originally used for floppy disk raw disk images only. A similar file extension, .ima, is also used to refer to floppy disk image files by some programs. A variant of raw image, called IMZ, consists of a gzipped version of a raw floppy disk image. These files use the .imz file extension, and are commonly found in compressed images of floppy disks created by WinImage.
      • QEMU uses the .img file extension for a raw image of a hard disk drive and calls the format "raw".
    • An .img file is just a raw disk image, a sector-by-sector copy of a storage device (like a hard drive, SSD, USB stick, etc.). It doesn’t have a special format; it’s literally just the binary contents of a disk.
    • .img was not a format invented by dd, it’s just a raw image file — a byte-for-byte copy of a disk.
  • IMA
    • (Virtual Floppy Disk Drive)
    • This is a binary blog, made by copying the RAW bits, and therefore is file system agnostic.
  • IMZ
    • GZipped (Virtual Floppy Disk Drive)
  • RAW
    • This is a binary blog, made by copying the RAW bits, and therefore is file system agnostic.
  • BIN
    • This is a binary blog, made by copying the RAW bits, and therefore is file system agnostic.
  • WIM
    • Microsoft Windows Image File
    • This is used to hold a Windows operating system and various other task.
    • This is not strictly a Disk Image file but can behave like one.
  • PHVD
    • Paragon
  • PMFX
    • DiskGenius 
  • E01
    • EnCase
  • AFF
    • (Advance Forensics Format)
  • EWF
    • (Expert Witness Compression Format)

Software

V2V and P2V

There will be cross over between software functionality and their category.

  • Conversion
  • Resizing
    • VhdResizer | Softpedia
      • A small and straightforward Windows utility designed to help users to shrink or expand the volumes of VHD files. Made in 2007.
      • How to Resize a Microsoft Virtual Hard Drive (VHD) File - When you create a Microsoft Virtual Hard Drive either through Virtual PC or Virtual Server, you have to specify the maximum size of the file up front.
    • VhdxTool
      • VhxdTool is a command line utility for Windows for quick creation and resizing of virtual hard disk files (VHDX).
      • This offers similar functionality to a former program vhdtool for Windows Server 2008/R2, but while vhdtool worked with older (VHD) format, vhdxtool works with the new (VHDX) format.
  • Compacting
    • vboxmanage
    • wslcompact
      • Compacts the size of the ever-growing WSL vhdx images.
      • Compacting the size of the ever-growing WSL images · microsoft/WSL · Discussion #9566 · GitHub
        • Give the usage commands of the tool.
        • Using virtual drives is a great idea. But, ext4 filesystem optimization inside VHDX images is not so well supported by the optimization tools. NTFS partitions are well optimized, but ext4 partitions are not so well optimized, and WSL suffers from this problem.
        • Since WSL doesn't provide a good solution for this, I have coded a small utility wslcompact that compacts the WSL partitions.
        • Any thoughts on improving the tool would be welcome. However, it would be better if the WSL team releases something similar. A good improvement would be an improvement in the export function, not only making a copy of the VHD file but dumping the contents in a newly created VHD, which would considerably reduce the size of the backup.
    • Optimize-VHD (Hyper-V Management Tools)
      • Needs Hyper-V to be installed. 
        Optimize-VHD -Path "Path\To\Your\VHDfile.vhdx" -Mode Full
    • DISKPART
      • Always present in Windows.
      • Optimize-Vhd doesn't require diskpart, of course, both processes can do more or less the same regarding drive compaction. Diskpart is somehow more convenient as it is readily available in all systems without the need for installing any extra package.
      • diskpart | Microsoft Learn - Reference article for the diskpart command interpreter, which helps you manage your computer's drives.
      • Compact a VHD file created by Disk Management? - Super User
        • You can then complete the compacting using diskpart from a Command Prompt
          1. Run diskpart
          2. Select the disk via its path: select vdisk file="<path>"
          3. Attach it as read-only: attach vdisk readonly
          4. Compact it: compact vdisk
          5. Upon completion of the compact, detach it again: detach vdisk
  • Image Creation (Disk)
    • DiskGenius: Data Recovery, Partition Manager, Backup & Disk Utilities
      • This software handles a variety of formats (.vmdk, .vhd, .vhdx, .vdi, .hdd, .img) but is read only in the free version, this means you cannot backup a drive to one of these formats with the free version. There is a proprietary DiskGenius disk image format (.pmfx) you can use for normal disk operations.
      • The paid version will also allow you to convert between the various Disk Image formats
      • You can also browse the files on disk images.
    • DiskImager
      • A simple but powerful tool for saving and writing disk images.
      • Save raw binary images of any disk as regular files.
      • Write disk images to physical disks.
      • When writing an image to a disk, supports industry-standard disk image formats (in addition to raw images), including VDI (VirtualBox), VMDK (VMware), E01 (EnCase), and VHDX/VHD (Virtual hard disk).
    • MultiDrive
      • 100% free disk management software for Windows. Clone, backup, restore, and erase drives with ease.
      • Allows you to create IMG of drives and I think also USB Drives.
    • Linux dd
      • This is a low-level command-line utility that copies data from one location to another, byte by byte. It's commonly used to:
        • Clone disks or partitions
        • Create disk images
        • Write ISO or IMG files to USB drives
      • How to Make Disk Images in Linux with the DD Command: An Essential Guide for Sysadmins – TheLinuxCode
        • Hey there! Do you manage Linux systems and need to make backups or clone disks? If so, the dd command should be part of your essential sysadmin toolkit. In this guide, I‘ll show you how to use dd to create complete disk images in Linux.
        • This is very comprehensive.
    • OSFClone
      • OSFClone is a free, open-source utility designed for use with OSForensics. OSFClone is a self-booting solution which lets you create or clone exact, forensic-grade raw disk images.
      • OSFClone is a free, self-booting solution which enables you to create or clone exact raw disk images quickly and independent of the installed operating system. In addition to raw disk images, OSFClone also supports imaging drives to the open Advance Forensics Format (AFF), AFF is an open and extensible format to store disk images and associated metadata, and Expert Witness Compression Format (EWF). An open standard enables investigators to quickly and efficiently use their preferred tools for drive analysis.
  • Image Creation (USB)
    • Rufus - The Official Website
      • Rufus is a small application that creates bootable USB drives, which can then be used to install or run Microsoft Windows, Linux or DOS.
      • This app also allows you to create disk image files (VHD/VHDX) of any USB pendrives plugged in.
        • These are fixed-size and raw, fully equivalent to a block-for-block disk image.
        • Rufus produces fixed (non-dynamic) VHD/VHDX images.
        • Fixed VHD/VHDX: Fully sized from the start, raw disk image with footer—this is what Rufus generates.
        • so reclaim the free space if you want to compact the drive, you woul dneed to convert to a Dynamix
      • Disk Format information
        • Why does Rufus call a .vhd file a DD Image? - Super User
          • Rufus developer here. This is because the save option is only for uncompressed VHD images, and uncompressed VHD images are just the same as DD images with an extra 512 byte footer added.
          • So, for all purposes, you can use DD to write the VHD image created by Rufus, and it will work just fine (with either the extra 512 byte footer being ignored as random data, if you use a larger sized disk, or being dropped, if using same exact same size disk).
          • Ergo, what Rufus creates when you click the save button is essentially a DD image since it can very much be used as such.
          • PS: For those who wonder why Rufus doesn't compress the VHD images it saves this is primarily due to the compression algorithm being used by Microsoft being very poor (IMO) and therefore not worth spending time implementing support for. This is also part of the reason why save as DD image is only available when clicking the advanced options.
        • Getting Rufus to output to a disk image file - Super User
          • Akeo
            • Rufus can create an uncompressed VHD image from whichever drive you have currently selected, which, for all intent and purposes can be used as a regular DD image (because the only difference with a regular DD image is an extra 512-byte footer, which, no matter how much you may think otherwise, will NEVER EVER come in the way of using the .vhd as a .img).
            • UPDATE: And recent versions can also create compressed VHDX images, that take less space, and that can work the same way.
          • gronostaj
            • Solution 1: Read the image from a prepared flash drive. Win32DiskImager can be used to do this.
            • Solution 2: Prepare your own hybrid ISO. Most of modern Linux distros use so called hybrid ISOs. They are valid ISOs that can be burned to a CD/DVD, but at the same time they are valid disk images that can be written to a flash drive. For example you could feed an Ubuntu ISO to Win32DiskImager and have it write it to disk (Rufus may offer this feature for some ISOs, it calls it "dd mode"). Community documentation on ISO customization is ten to thirteen years old, but may still be useful and you'll find many useful guides all over the Internet.
        • Make image from disc · Issue #1274 · pbatard/rufus · GitHub
          • Aha, then this is my cue to enlighten you: 
          • An uncompressed is just a DD image with a 512 byte footer added.
          • Therefore, because writing that footer (or not) is inconsequential, you can absolutely use the .vhd that was created by Rufus as a DD image.
          • Now, in case you have doubts about those extra 512 bytes potentially causing an issue let me explain that:
            • If you are restoring the image to a drive of the exact same size as the one you used to create the VHD, then these 512 bytes will happily be dropped by dd (At least the Linux version of dd doesn't care much if you try to write more data that the drive can hold - it'll report it, but it will not have any kind of impact on the data written), leaving you with a 1:1 copy of the original drive.
            • If you are using a drive that is larger than the one you used to create the VHD, then, even if you are unfortunate enough to have the 512-byte VHD footer fall at the precise location where the GPT backup is located (a few sectors before the end of the drive), then because this is a backup, any modern OS will detect that the backup is corrupted and fix it by duplicating the master, which is located at the beginning of the disk. Oh, and, even when you restore a pure GPT based DD image onto a larger drive, this kind of GPT backup fix needs to happen anyway, since, obviously, the backup GPT from the original image is at the wrong location, and a new backup GPT needs to be created at the right one. In other words, the writing of that 512-byte VHD footer is no different than the case of expecting whatever garbled data one might find at the expected location for the backup GPT when writing a "regular" DD image. And really, even as this is a complete non-issue, the possibility that the VHD footer will fall at the precise location where the backup GPT should go is exceedingly small. Oh, and if your image is using a MBR partition table, then it's even less of an issue, because none of the data up to (size of VHD - 512 bytes) will EVER be seen as accessible from the original image.
          • In summary, and I really have to stress this out, for all purposes, an uncompressed VHD image is exactly the same as a DD image. Therefore you can use the Rufus created .vhd exactly as you would use a standard DD image. There REALLY is no "What if...?" or "But surely..." associated to using an uncompressed .vhd as you would a DD image.
      • Disk image created by Rufus is shown as a growable image and not as a fixed disk
        • Why This Happens
          • Rufus does not create truly dynamic (growable) disks. Instead, it writes raw, fully allocated (fixed-size) disk images, even when saving to .vhdx format. But:
            • Rufus doesn't explicitly write the full VHDX metadata headers the same way Hyper-V or Windows Disk Management does.
            • This can cause third-party tools like StarWind to misinterpret the image format or default to "growable" in their interface or assumptions.
        • Evidence & Explanation
          • StarWind is designed to work with officially structured VHDX files (including all metadata).
          • Rufus writes uncompressed, flat VHDX files but doesn’t necessarily populate all optional VHDX metadata fields.
          • StarWind may detect the structure or size mismatch and label it as "growable" (which usually means "dynamic")—even if it's not actually dynamic.
        • How to Check What It Really Is
          • You can confirm the truth using:
          • PowerShell 
            Get-VHD -Path "C:\path\to\your.vhdx"
            • Look for VHDType: Fixed or Dynamic
          • vhdxinfo (from libvhdi) 
            vhdxinfo mydisk.vhdx
            • It will show you type: fixed or type: dynamic explicitly.
        • Workaround or Fix
          • If you want the VHDX to be 100% standards-compliant and recognized as "fixed" by all tools (including StarWind), do this:
            1. Mount the Rufus-generated VHDX in Windows.
            2. Create a new fixed-size VHDX using: 
              New-VHD -Path "C:\fixed-compliant.vhdx" -SizeBytes 10GB -Fixed
            3. Use dd or xcopy to clone contents to the new disk.
          • This gives you a 100% spec-compliant VHDX that should show as "fixed" in all tools.
    • ImageUSB
      • ImageUSB is an effective tool for writing an image to multiple USB Flash Drives for mass duplication and creating images of thoese drives.
      • ImageUSB is a free utility which lets you write an image concurrently to multiple USB Flash Drives. Capable of creating exact bit-level copies of USB Flash Drive (UFDs), ImageUSB is an extremely effective tool for the mass duplication of UFDs.ImageUSB also supports writing of an ISO file byte by byte directly to an USB drive (*). ImageUSB can also be used to install OSFClone to a USB Drive for use with PassMark OSForensics™.
      • Unlike other USB duplication tools, ImageUSB can preserve all unused and slack space during the cloning process, including the Master Boot Record (MBR). ImageUSB can perform flawless mass duplications of all UFD images, including bootable UFDs.
      • ImageUSB includes functionality to Zero a USB Flash Drive. This will replace the contents of the entire drive with 0s. Or alternatively to just Zero the MBR and/or GPT entries that exists on the drive. In addition, imageUSB has the ability to reformat even hard to format drives and reclaim any disk space that may be lost previously.
      • (*) CD ISO images use a different file systems compared to USB drives. So the direct imaging of ISO9660, Joliet or UDF file system, from a CD, to a USB drive, might not allow the USB drive to function in all operating systems. A reformat can recover the drive however. As of V1.5, imageUSB now supports extraction of ISO contents onto USB Drive.
      • Warning: Due to the forensic nature of image duplication by ImageUSB, please ensure that you select UFDs with a storage size similar to the image you wish to duplicate. For example, if a 2GB image is copied to an 8GB USB Flash Drive, the drive will only be able to use two out of the eight gigabytes of storage space. In this scenario, users will need to reformat the UFD in order to access the rest of the storage space.
    • USB Image Tool – alex's coding playground
      • USB Image Tool can create images of USB flash drives, SD cards and any other devices that are mounted as USB storage drives.
      • It can create an exact byte copy of these devices in raw and compressed image formats and also restores or write images on the device.
      • USB Image Tool works with any device, that implements the USB Mass Storage protocol. This includes flash drives, card readers/SD cards and a lot of other devices like digicams, cell phones and mobile music players.
    • USBImager
      • A really simple GUI application that writes compressed disk images to USB drives
        and creates backups. Available platforms: Windows, MacOSX and Linux. Its interface is as simple as it gets, totally bloat-free.

Disk Image Repair software

Other Software

  • sDelete (Secure Delete)
    • SDelete - Sysinternals | Microsoft Learn - Securely overwrite your sensitive files and cleanse your free space of previously deleted files using this DoD-compliant secure delete program.
    • How to use the command 'sdelete' (with examples) - Secure deletion is an essential part of data management and protection, particularly when it involves sensitive information. The command-line tool ‘sdelete’ offers a robust solution by permanently erasing files, directories, or entire volumes, thus ensuring that data cannot be recovered. Developed by Sysinternals, ‘sdelete’ employs advanced algorithms to overwrite data, mitigating the risk of unauthorized data access. Below we explore various use cases, each tailored to different secure deletion needs.
    • Meet Sdelete, the obscure Microsoft tool that wipes data for good | PCWorld - Sdelete, short for Secure Delete, is a powerful but little-known tool from Microsoft's Sysinternals suite that permanently wipes files and folders by overwriting data.
    • How to use SDelete to ensure deleted data is gone for good | TechTarget - Standard delete functions aren't good enough to guarantee data is gone for good. Learn how to use SDelete to ensure your information is removed permanently.

Mounting and Managing Images (in Windows)

  • Windows can mount VHD and VHDX natively.
  • Simple VHD Manager v1.5 - Simple Vhd Manager helps Virtual Hard Drive (VHD/VHDX) users to create and attach them or add them to boot menu.It is a Portable freeware
  • DAEMON Tools Lite: The most personal application for disc imaging yet - DAEMON-Tools.cc - DAEMON Tools Lite allows you to mount all known types of disc image files and emulates up to 4 DT + SCSI + HDD devices. It enables you to create images of your optical discs and access them via well-organized catalogue.
  • Arsenal Image Mounter - Arsenal Image Mounter mounts the contents of disk images as complete disks in Windows.
  • FTK Imager - Forensic Data Imaging and Preview Solution | Exterro
    • A free data preview and imaging tool used to acquire electronic evidence in a forensically sound manner by creating copies of computer data without making changes to the original evidence.
    • With FTK Imager, you can create forensic images of local hard drives, CDs and DVDs, thumb drives or other USB devices.
    • Mount an image for a read-only view that leverages Windows® File Explorer to see the content of the image exactly as the user saw it on the original drive.
  • OSFMount - Mount Disk Images & Create RAM Drives
    • The free OSFMount tool mounts raw disk image files in mulitple formats. You can also create RAM drives. Formats supported include img, dd, E01, VHD, ISO & bin
    • Instructions
      • Step 1 of 4: Just select your disk image, do not mount as ram disk
      • Step 2 of 4: Mount entire image as virtual disk
      • Step 3 of 4: Skipped by the software, ,ust be somethign to do with partitions
      • Step 4 of 4:
        • Read-only drive: Optional, but readonly keeps the original image clean
        • Write mode: Write cache
        • Drive emulation: Physical Disk Emulation = we need this for the boot sector
        • Drive type: HDD
      • NB:
        • In Starwind, your virtual disk will be listed as real disk called osfdisk
        • If you mount as FDD (possible a super floppy mode) Starwind will not see the drive.
    • OSFMount - What is the difference between logical and physical drive emulation modes:
      • In OSFMount, the difference between logical and physical drive emulation lies in how the mounted image is presented to the operating system:
        • Logical Drive Emulation
          • What it is: Mounts a partition within a disk image as a drive.
          • Use case: When you're only interested in accessing a specific partition (e.g., a file system like NTFS or FAT32).
          • Example: Mounting just the C: partition from a full disk image.
          • Visible as: A standard drive letter in Windows (e.g., D:, E:).
          • No boot sector or MBR is emulated—just the file system content.
          • Faster and simpler for common use cases like extracting files.
        • Physical Drive Emulation
          • What it is: Mounts the entire image as if it were a real physical disk, including the MBR, partition table, and all partitions.
          • Use case: When you need to work with the full disk structure (e.g., for forensic analysis or imaging software that requires MBR access).
          • Visible as: A physical disk (not a drive letter), usually accessed via disk management tools or forensic software.
          • Can emulate multiple partitions, raw sectors, boot records, etc.
          • Slower and more resource-intensive, but gives low-level access.
      •  Forum
        • OSFMount decides automatically whether to use physical or logical emulation based on the presence of a partition table in the image.
        • OSFMount shall automatically mount using Physical Drive or Logical emulation based on whether the image file contains a partition table or not
      • Another forum post clarifies the difference in practical terms:
        • Logical emulation: mounts only the file system as a volume — you get a drive letter but no low-level disk access..
        • Physical emulation: mounts the entire disk, including all sectors and partitions — useful for low-level forensic or VM boot tasks

DAEMON Tools Lite: The most personal application for disc imaging yet - DAEMON-Tools.cc

  • A well-known solution that allows you to mount, copy and create an image. It works with the most popular types of virtual discs. Download DT Lite to mount images without any limits!

Simple VHD Manager v1.5

  • Simple VHD Manager is portable freeware which helps VHD users simplify some of these operations:
    • You can attach and detach VHD/VHDX/ISO files via drag and drop
    • You can permanently attach a virtual hard disk in Windows 11 – 10 – 8,1 – 8 and Windows 7
    • You can easily add and/or remove VHD/VHDX/ISO files to the boot menu
  • Mount and Unmount a VHD File in Windows Explorer via a Right-Click
    • Virtualization has become an incredibly powerful and flexible way to deploy environments. So much in fact that Microsoft has integrated the ability to attach virtual hard drive (VHD) files as physical disks in the Windows Disk Management tool.
    • This process is easy enough to do manually but if you attach VHD files often then we have a solution which enables you to mount and unmount VHD files with a single click.
    • Thsi article has batch scripts you can attach to the context menu to allow easy use of the right click feature.

Best Practices

  • Fixed vs Dynamic disks - Microsoft Q&A - Hi Can anyone point me to a link that shows the correct official guidance from Microsoft as to if fixed or dynamic VHD's or VHDX's should be used in a production enviroment? Thanks

Tutorials

  • Create from Scratch
  • Export/Import Virtual Machines
  • Shrinking and Compacting
    • How to Shrink and Compact VHDX Files in Hyper-V? | Vinchin Backup
      • This article serves as a comprehensive tutorial on managing VHDX disk space in Microsoft Hyper-V environments.
      • It differentiates between shrinking and compacting VHDX files, outlines the advantages of the VHDX format over the older VHD, and provides detailed steps to perform both shrink and compact operations using both Hyper-V Manager and PowerShell commands.
    • How to Shrink and Compact Virtual Hard Disks in Hyper-V | TheWindowsClub - In this post, we will see how to shrink and compact hard disks in Hyper-V. This allows you to make room for the hard disks if they are too big for your physical computer. Since Hyper-V hard disks are usually dynamic in nature, it is crucial to shrink and compact virtual hard disks in Hyper-V.
    • How to Shrink the Virtual Disk of a Linux Distro in WSL | by bonguides.com | Medium - When you delete files or free up space in your WSL distribution, the virtual disk doesn’t automatically shrink. To reclaim this unused space, you need to compact the virtual disk (VHDX) file.
      • Diskpart 
        • Open PowerShell (Terminal) as administrator then type diskpart and press Enter
        • Use the following command, replacing the path with the actual location of your VHDX file to select the VHDX file. 
          select vdisk file=""
        • Once the disk is selected, run the below command within the DiskPart prompt to shirk the disk. This will reclaim the unused space in your VHD file. You should see a message indicating that the disk has been successfully compacted 
          compact vdisk
        • After the process is complete, you can check the size of the VHD file to confirm that it has been reduced.
      • Hyper-V
        1. Open PowerShell as administrator, then navigate to the location of the VHD file
        2. Run the following command to compact the VHD file: 
          Optimize-VHD -Path .ext4.vhdx full
        3. You can monitor the processing status on the screen. After completion, verify the virtual disk size to confirm functionality.
      • WSLCOMPACT
        • Install it using the below PowerShell commands: 
          Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
iwr -useb https://raw.githubusercontent.com/okibcn/wslcompact/main/setup | iex
        • Run the wslcompact command to see the current size and estimated size of all WSL instances.
        • Run the below command to compact the disk and apply the change to the VHD file. 
          wslcompact -c ubuntu
        • If the tool is no longer needed, to remove the utility, close all your PowerShell instances, open a fresh one, and type: 
          Remove-Item "$($env:PSModulePath.split(';')[0])/WslCompact" -Recurse -Force
    • Shrink and Compact Virtual Hard Disks In Hyper-V (Guide) - If your Hyper-V environment starts running low on disk space, find out how to shrink and compact virtual hard disks in this step-by-step guide.
    • How to Shrink and Compact Virtual Hard Disks in Hyper-V - TechDirectArchive
      • Master the process of shrinking and compacting your Hyper-V virtual hard disks to save space and enhance virtual machine efficiency.
      • Different method iusing: Hyper-V Manager, PowerShell, Resize-VHD
    • WSL2 on Windows 11 - Virtual Disk vhdx is 200GB now | Reddit
      • Release VHDX unused space:
        Open Powershell and run the following:

wsl --shutdown

diskpart

select vdisk file="path-to-your-virtual-disk\ext4.vhdx"

attach vdisk readonly

compact vdisk

detach vdisk

exit
    • How to Compact/Shrink a WSL2 Virtual Disk – Stephen Rees-Carter
      • You can use the diskpart tool to compact a VHDX. This allows you to shrink a WSL2 virtual disk file, reclaiming disk space. I went from 100GB to 15GB.
    • How to Compact a WSL2 VHDX Virtual Disk | mycodde.blogspot.com - I was struggling to compact my WSL VHDX disk, it has hardly 10 GB data but it was showing 72 GB in size. 
  • Resizing
  • Starwind V2V Converter
  • VMware vCenter Converter Standalone
  • QEMU
  • VBoxManage
    • Converting disks (vboxmanage clonemedium)
      • Convert VMDK to VirtualBox VDI and compact disk - How to convert the vmdk to a VDI file and then compact it. 
        ## Convert
VBoxManage clonemedium disk --format VDI [drive]:[\path_to_file\sourceFile.vmdk] [drive]:[\path-to\destinationFile.vdi]

## Compact
VBoxManage modifyhd --compact "[drive]:\[path_to_image_file]\[name_of_image_file].vdi"
    • resize VDI image size 
      VBoxManage modifyhd "[drive]:\[path_to_image_file]\[name_of_image_file].vdi" --resize 81920
    • RAW Disk handling
      • vboxManage internalcommands createrawvmdk - Bing Search
        • The VBoxManage internalcommands createrawvmdk command in VirtualBox allows you to create a virtual disk that maps to a physical disk or partition. This is useful for accessing a physical disk directly from a virtual machine.
        • Example
          • To create a virtual disk that maps to an entire physical disk on a Windows host, use the following command: 
            VBoxManage internalcommands createrawvmdk -filename "C:\path\to\file.vmdk" -rawdisk \\.\PhysicalDrive0
          • This command creates a .vmdk file that represents the physical disk PhysicalDrive0
        • Accessing Specific Partitions
          • You can also map specific partitions of a physical disk. For example, to map partitions 1 and 5 of /dev/sda on a Linux host: 
            VBoxManage internalcommands createrawvmdk -filename /path/to/file.vmdk -rawdisk /dev/sda -partitions 1,5
          • This creates a .vmdk file that provides access to partitions 1 and 5 of /dev/sda
        • Important Considerations
          • Permissions: Ensure you have the necessary read/write permissions for the physical disk.
          • Data Safety: Incorrect use can lead to data loss. Avoid accessing the same partition from both the host and guest simultaneously.
          • Platform Differences: The device specification varies by platform (e.g., \\.\PhysicalDrive0 for Windows, /dev/sda for Linux).
        • Using VBoxManage internalcommands createrawvmdk, you can effectively utilize physical disks within your VirtualBox VMs, providing flexibility and direct access to hardware resources.
        • Learn more
      • Example Commands 
        vboxManage internalcommands createrawvmdk -filename "C:\Users\Public\Documents\VirtualBox\Raw Disk Images\spinrite.vmdk" -rawdisk "\\.\PhysicalDrive2"

vboxManage internalcommands createrawvmdk -filename "C:\rawdisks\spinrite.vmdk" -rawdisk "\\.\PhysicalDrive2"
      •  Use physical harddisk in Virtual Box - Straight forward instructions - Super User - Today, I managed to boot from physical drives. This achievement required....
  • How to Read VHDX Metadata (e.g., virtual size, block size)
    • PowerShell
      • Run: Get-VHD -Path "C:\path\to\your.vhdx"
        • This returns
          • VHD type (Fixed/Dynamic)
          • Size
          • Logical sector size
          • Physical sector size
      • Note: Only works on Windows with Hyper-V features installed.
    • Use vhdxinfo from libvhdi (Linux/macOS/Windows)
      1. Install libvhdi tools:
        • On Linux: sudo apt install libvhdi-utils
        • On macOS (via brew): brew install libvhdi
        • On Windows: Download libvhdi
      2. Run: vhdxinfo yourfile.vhdx
        • This will show:
          • Header info
          • Log GUIDs
          • Virtual disk size
          • Block size
          • Parent locator (if differencing disk)
    • Parse the VHDX File Manually (Hex or Script)
      • You can parse the structure using a hex editor or script:
        1. Look for the magic header at offset 0: 
          00000000  76 68 64 78 66 69 6c 65   # "vhdxfile"
        2. Read region table at 0x20000, which lists metadata regions.
        3. Use the region table to find:
          • Virtual disk size
          • Block size
          • Logical/physical sector size
          • GUIDs, versioning
      • You'd need to follow the Microsoft VHDX Specification to decode it fully.
  • TRIM'ing VHD(X) files
    • Optimize-VHD (Hyper-V) | Microsoft Learn
      • Optimizes the allocation of space used by virtual hard disk files, except for fixed virtual hard disks.
    • Optimize-Volume (Storage) | Microsoft Learn
      • Optimizes a volume.
      • The Optimize-Volume cmdlet optimizes a volume, performing defragmentation, trim, slab consolidation, and storage tier processing. If no parameter is specified, then the default operation will be performed per the drive type as follows:
        • HDD, Fixed VHD, Storage Space. -Analyze -Defrag.
        • Tiered Storage Space. -TierOptimize.
        • SSD with TRIM support. -Retrim.
        • Storage Space (Thinly provisioned), SAN Virtual Disk (Thinly provisioned), Dynamic VHD, Differencing VHD. -Analyze -SlabConsolidate -Retrim.
        • SSD without TRIM support, Removable FAT, Unknown. No operation.
    • Multiple VHD/VHDx Optimization using PowerShell Workflows
      • Optimize multiple VHD/VHDx files using PowerShell Workflows.
      • After about 5 minutes of investigation I came up with this simple PowerShell command:
        Get-VM | Where { $\_.State -eq 'Off' } | Get-VMHardDiskDrive | Optimize-VHD -Mode Full
      • It basically performs a full optimization on all VHD/VHDx files attached to all Virtual Machines that are in the Off state on the host the command is run on. This does the job quite well but has a few annoyances:
        • The optimization is performed in series.
        • Running guests won’t be optimized.
        • The command only works on VMs on the host the command is run on.

Convert and Compact an Offline VHD/VHDX Fixed Disk Image to a Dynamic Disk Image

  • TRIM is the process of the OS telling a SSD/NVMe drive to release the sector as it is no longer used, these drives do not actually zero fill the sectors to prevent uneeded writes, but in the future when the sector is read, the drive will supply back all Zeros.
  • In a Fixed Disk Image, an unused sector is denoted by being all Zeros.
  • In a Dynamic Disk Image, an empty unused sector is either all Zeros or is juts not referenced at all, in either case, all Zeros will be returned.
  • If the Disk Image files is part of an online system, the OS it is running can perform TRIM on the drives and volumes to "Zero out" unused sectors.

Instructions

VHD and VHDX are interchangeable for these commands.

  • Mount the Disk image 
    Mount-VHD -Path "D:\Path\To\Fixed-Disk.vhdx" -ReadOnly

Or

Mount through the GUI (Disk Management, Right Click)
    • -ReadOnly: This should protect the volume being written to by the OS, but not this command. I am not 100% on this.
  • Zero out free space (inside the VHDX) (TRIM)
    • You need to fill the free space with zeros so the compacting process knows it’s unused.
    • Use sdelete from Sysinternals: 
      sdelete64.exe -z X:
    • Replace X: with the drive letter assigned to the mounted VHD.
    • -z: This flag instructs ‘sdelete’ to write zeros over the available free space, a less intensive option than multiple passes and suitable for non-critical data.
    • This is needed because when a full RAW image of a drive is done, all bits are stored into the image, irrespective of whether that sector is holding any data.
  • Unmount the VHDX 
    • Dismount-VHD -Path "D:\Path\To\Fixed-Disk.vhdx"

Or

Unmount through the GUI (Disk Management, Right Click)
  • Convert the Fixed VHDX to Dynamic.
    • Powershell 
      Convert-VHD -Path "D:\Path\To\Fixed-Disk.vhd" -DestinationPath "D:\Path\To\Dynamic-Disk.vhd" -VHDType Dynamic
    • Use StarWind V2V / P2V Converter to convert the Fixed disk to a Dynamic disk
      • This process actually generates a copy of the disk image.
  • Compact the Dynamic VHDX.
    • Using Powershell 
      Optimize-VHD -Path "D:\Path\To\Dynamic-Disk.vhdx" -Mode Full
    • Using Diskpart 
      diskpart
select vdisk file="D:\Path\To\Dynamic-Disk.vhdx"
attach vdisk readonly
compact vdisk
detach vdisk
exit
      • readonly: This should protect the volume being written to by the OS, but not this command. I am not 100% on this.
  • Done

Running Trim in a live OS

  • Virtual Drive TRIM - VergeOS Docs - How to regain space on a virtual SSD
    • After importing a virtual machine from another hypervisor, sometimes the free space available inside the virtual machine does not match the free space reported to the VergeOS platform.
    • This discrepancy is often due to the virtual disk being thick-provisioned from the VM source, making VergeOS unaware of the unused disk space.
    • To resolve this, a TRIM/UNMAP operation needs to be performed on the virtual disk from within the virtual machine.
    • Trimming a Windows Drive 
      Optimize-Volume -DriveLetter YourDriveLetter -ReTrim -Verbose

Optimize-Volume -DriveLetter E -ReTrim -Verbose
    • Trimming a Linux Drive 
      ## Check TRIM Timer/Schedule Status:
sudo systemctl status fstrim.timer

## Check TRIM Service Status:
sudo systemctl status fstrim

If TRIM is enabled, an operation will run at the next scheduled time. If TRIM is not enabled, you can

## Run a manual TRIM using:
sudo fstrim -av

## Info
It is recommended to enable automatic TRIM to ensure that data usage is reflected accurately between VergeOS and the guest OS.

## To enable automatic TRIM, run:
sudo systemctl enable fstrim.timer

Repairing Disk Images

Partition Types

Makes your USB drive appear as a Hard drive and not removable Media

Is htis best ehre or antoher article

TL;DR = Might not be possible any more, and if it is, it is not worth the hassle.

  • Flip the Removable Media bit (RMB) on the drive itself
    • The Lexar BootIt utility was designed to "flip the removable media bit" on certain USB flash drives, making them appear as fixed (hard) disks to Windows. This was a niche utility and often highly specific to particular flash drive controllers. It's largely outdated and generally not recommended due to potential instability and the possibility of bricking your USB drive.
      The "removable media bit" is often a hardware-level setting within the USB drive's controller firmware. So, if a utility like Lexar BootIt doesn't work for your specific drive, there's often no generic software alternative that can reliably change this "bit."
    • Flip Your Bit USB Utility To Make Local Drive | getusb.info
      • BootIt is a Lexar based utility to flip the Removable Media Bit setting of a USB drive. What this means, is you can take a Lexar drive (and many other brands) and make it appear as a Local Drive on your PC rather than Removable Storage.
    • Removable USB Flash Drive as Local HDD in Windows | Windows OS Hub
      • In this article we’ll show you how to make a USB flash drive or an SD card to be identified in the Windows as a common local hard disk.
      • Probably, you may ask why it’s necessary? The matter is that by default Windows identifies all the USB flash drives and SD cards as removable drives that can’t be split into several partitions with the built-in Windows tools.
      • And even if you partition the USB flash drive into two or more volumes using third-party utilities (say, in Linux), only the first partition will be available in Windows. Windows supports multiple partitions only for hard disk drives identified as local (i.e. non-removable).
      • Windows recognizes USB flash drives as removable devices due to the presence of a special descriptor bit RMB (removable media bit) on each of the devices. If the system determines that RMB=1 when polling the connected device using StorageDeviceProperty function, it concludes that this device is a removable drive. Thus, in order to convert the USB-flash to the hard disk it is enough to modify this descriptor. 
      • Software covered
        • Lexar BootIt
        • Hitachi filter driver
    • How to make a disk drive "removable" - Windows 10 Forums - No meta description
  • Windows Registry
    • The mode cannot be changed in the Windows registry.

 

Read 48 times Last modified on Friday, 25 July 2025 08:17
Published in Virtual Machines
back to top