Forensicswiki.org has moved to this site, forensicswiki.xyz. For information, please join the Google Group forensicswiki-reborn
Virtual Hard Disk (VHD)
The Virtual Hard Disk (VHD) commonly uses the .vhd extension.
This format is used to store virtual disk images by:
- Microsoft Virtual PC
- Microsoft Virtual Server
- Microsoft Hyper-V Server
VHD support is also integrated into Windows (at least in Windows 7) where "Disk Management" (part of "Computer Management") supports attaching and creating Fixed and Dynamic VHD image files.
There are multiple types of Virtual Hard Disk (VHD) images:
- Fixed-size hard disk image; the image contains all data
- Dynamic-size (or sparse) hard disk image; the image contains used data only
- Differential (or differencing, or delta) hard disk image; the image contains changes relative to its parent image
Hyper-V has functionality to create snapshots.
These snapshots are stored in Snapshot Differencing Disk (AVHD) files which commonly uses the .avhd extension.
The snapshot can be interdependent on one-another, because they are differential images of the previous snapshot.
- VHD (file format), by Wikipedia
- Virtual Hard Disk Image Format Specification, by Microsoft, October 2006
- Overview of VHD & VHDX Virtual Hard Drive An overview of virtual hard drive image files
- Virtual Hard Disk (VHD) image format, by the libvhdi project, September 2012
- Hyper-V Concepts - Snapshots
- Virtual Machine Snapshotting under Hyper-V
- Hyper-V SnapShot Files – AVHD and VHD? What The ?
- Manually Merge .avhd to .vhd in Hyper-V