Disk imaging of Virtualbox VM Snapshot ?

[Sim4n6]

Hi,

Is there a simple way to Disk imaging of a VirtualBox VM Snapshot ?

Thank you

[socratis]

If you define what "Disk imaging" is (or what it means to you), then maybe we could help you. Remember, this is not Twitter, you are allowed to use more than 140 (280) characters to describe your problem with more/full details. Please do...

[Sim4n6]

alright why not

well disk imaging is a disk to file operation.

I mean in digital forensics domain, we frequently forensically sound disk image a drive. But if I am experimenting using VirtualBox VM Manager and I have multiple Snapshots, I don't know how to extract the Disk part. I suppose since snapshots are files and saved on a file, there is definetly a file inside that contain only the filesystem ...

[Sim4n6]

clonehd command may answer my question but does it work for snapshots too ? or maybe clonemedium command I am still investigating

[socratis]

Snapshots (and differencing images) work at the sector-by-sector modification level, not file-by-file. I started writing a draft (got to finish this at some point) explaining the basics of snapshots. Read it together with the manual to better understand what we're talking about.

As for your question, "clonemedium" (clonehd is the same thing, but deprecated) should do what you want, if you give it the snapshot UUID. You could also do it from the GUI, if you go to the Snapshots view (under Machine Tools), select the snapshot you're interested in, right-click and select "Clone". You're going to have 3 options:

• Current machine state
• Current snapshot tree branch
• Everything

Pick what's appropriate for your use case. If you need more help/examples, feel free to ask...

[Sim4n6]

Thank you for your answer