Home

CnW Recovery will read Virtual disk images, as part of the forensic option.

The Virtual disk image is selected as an image file and is recognised as the start sector has a signature 'KDMV', ie VM DK as little endian.

The routine in V3.62 handles disk images upto 2GB in length. This limit will be increased in later releases.  The format works by having a look up table that allocates space to the data.  Thus the VMDK inage file may be considerably smaller than the disk image it represents. 

The file format is defined by the standard VMware Virtual disks (format 1.1)