VMware Virtual Disk (VMDK)
| Format | VMware Virtual Disk (VMDK) |
|---|---|
| Short name | VMDK |
| Category | disk_image |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
VMware virtual disk. A disk is a text descriptor ('# Disk DescriptorFile') naming one or more extents — sparse ('KDMV', older ESX 'COWD'), stream-optimized (compressed, as in OVA/OVF exports), flat (the disk's bytes as they are) or SESPARSE — embedded in the descriptor's file or stored beside it, often split into 2 GB pieces. A snapshot is a delta disk holding only what changed since its parent; the disk's content spans the chain. Used by VMware Workstation, Fusion and ESXi, and by VirtualBox. Snapshots and suspended VMs come with .vmem and .vmsn files beside the disk that hold the VM's memory.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 4B 44 4D 56 | KDMV | Sparse extent magic 'KDMV' |
| offset 0 (0x0) | 43 4F 57 44 | COWD | Older ESX sparse (COWD) extent |
| offset 0 (0x0) | 23 20 44 69 73 6B 20 44 65 73 63 72 69 70 74 6F 72 46 69 6C 65 | # Disk DescriptorFile | Standalone VMDK descriptor file |
Known extensions
.vmdk
References
- VMware Virtual Disk Format (VMDK) — format documentation (libyal/libvmdk) https://github.com/libyal/libvmdk/blob/main/documentation/VMWare%20Virtual%20Disk%20Format%20(VMDK).asciidoc
- ForensicsWiki — VMware Virtual Disk Format (VMDK) https://forensics.wiki/vmware_virtual_disk_format_(vmdk)/
- abrignoni/ewfprobe — pure-Python reader for EWF (E01, S01, Ex01, L01), AFF/AFF4, AD1 and virtual/Apple disk images https://github.com/abrignoni/ewfprobe
Cite this entry
Crush Format Reference, “VMware Virtual Disk (VMDK)”. https://kalink0.github.io/crush-forensics/formats/vmdk/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction