Skip to content

vhdx block driver should support 4096 byte sector sizes

Hello,

I'm trying to mount a vhdx file obtained from a Windows machine for forensic analysis purposes. It has both PhysicalSectorSize and LogicalSectorSize attributes set to 4096, and whenever I try to run either qemu-img or qemu-nbd on it, I get the following error:

$ qemu-img info sector_test.vhdx
qemu-img: Could not open 'sector_test.vhdx': Could not open 'sector_test.vhdx': Operation not supported

If I manually change the LogicalSectorSize attribute with a hex editor to 512:

image.png

image.png

I can get the image info and I can mount it with qemu-nbd, but of course, the sectors are now misaligned so the partitions cannot be accessed properly. However I can still access the data and mount the partitions by specifying the offset from the raw block device.

$ qemu-img info sector_test.vhdx 
image: sector_test.vhdx
file format: vhdx
virtual size: 10 GiB (10737418240 bytes)
disk size: 1.6 GiB
cluster_size: 33554432

image.png

The vhdx file can be mounted natively by Windows with no issues, but it also fails with qemu-img on Windows with the following error:

qemu-img.exe: Could not open 'sector_test.vhdx': Could not open 'sector_test.vhdx': Unknown error

Some extra information:

  • Host OS: Ubuntu 22.04 (also tried with RHEL 10, same thing)
  • QEMU version: tried the one from APT repositories and compiling from master

To reproduce you can just create a vhdx file from Windows disk management or any other means, edit the logical sector size to be 4096 (by default it is 512 but 4096 is explicitly allowed in the spec), and then try to run qemu-img on the file.

I will be happy to provide extra information if needed,

Thanks.

Edited by dfr -
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information