Access to a virtual disk/disk image located inside another virtual storage
One storage medium comprising another virtual storage within its structure is a quite typical situation for virtualized environments. For example, a RAID set may contain virtual disks or disk images stored as regular files within its file system. The user creates an image of the physical device, but the actual data to be recovered may be located inside the "nested" virtual storage medium. As the number of storage layers grows, the task becomes exponentially more challenging, especially in case of SAN systems, when the latter store their virtual volumes as disk images within underlying RAID storage pools.
Such "nested" virtual disks and disk images present a problem for most data recovery tools. Not all software is capable of opening virtual storage media stacked within a larger storage, requiring the user to manually extract the virtual disk or disk image file before accessing its content. This process may be time-consuming or even impossible in certain scenarios. Fortunately, UFS Explorer of the Professional and Technician editions simplifies it significantly by allowing users to open such files directly from the host file system. The feature is particularly useful for professionals dealing with virtualized setups or digital forensics investigations.
The possibility is implemented in the software via a dedicated option – "Open as a disk image" available in the context menu of disk image and virtual disk files.
The corresponding tool is also presented in the main toolbar of the Explorer element launched either is the file system access or scanning results mode.
To illustrate how it works in practice, let’s consider a scenario with a VMware ESXi datastore stored on a RAID 5 set. This datastore contains a VMDK virtual disk representing a virtual machine’s storage. We need to recover files from the virtual machine. The array itself is not available, but we have disk images created for its member drives.
First, we need to load our disk image files into UFS Explorer.
The software promptly reconstructs our RAID 5 from the detected RAID components.
Once the RAID structure is assembled correctly, the VMFS6 file system becomes accessible.
We have to browse this file system and find the nested VMDK virtual disk.
Once our VMDK file is located, we can select this virtual disk and open it straight away by applying the "Open as a disk image" tool.
The software mounts this VMDK in its interface as a separate virtual storage, as if it were just another physical drive.
Now we can browse, find and recover files from it just as we would on any stand-alone device.
Last update: March 11, 2025