0

I have a VHDX file (representing a non-boot ext4 fs) that I need to run some forensics on.

I have a working CentOS7 HyperV VM on a Win2012R2 host.

I want to attach the VHDX to the CentOS7 VM, which I know how to do.

What I don't know how to do exactly is to tell CentOS 7 that, when it boots up, if it sees the new IDE device that the VHDX file will become in its VM, not to try mounting it read-write (or at all, preferably.) Is there an /etc/fstab line that force either read-only mounting or to not try mounting at all?

Motivation: Since the VHDX is huge, making a backup of it is time-consuming, so I just want to get it right from the beginning, and not accidentally modify any of the data (especially if the ext4 is corrupted) before I analyze it with foremost.

Improve this question
2
  • Create a differencing disk against the VHDX, and attached the differencing disk instead. All writes will be directed to the differencing disk. That way if anything gets messed up, you can just throw away the differencing disk.
    – longneck
    Mar 20, 2015 at 15:16
  • @longneck if anything gets messed up, I won't be able to get the data back, all within the VM session. I want to prevent the messing up inside the VM, not make it reversible outside the VM.
    – Kev
    Mar 20, 2015 at 15:28

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .