Preventing a read-write first automount after adding a VHDX onto a CentOS7 HyperV VM

I have a VHDX file (representing a non-boot ext4 fs) that I need to run some forensics on. I have a working CentOS7 HyperV VM on a Win2012R2 host. I want to attach the VHDX to the CentOS7 VM, which I know how to do. What I don’t know how to do exactly is to … Read more

AVHDX internal format for use with TestDisk

I can’t seem to find any info about this. What is a HyperV differential AVHDX file format internally like, for the purpose of forensic recovery? That is: Is it just straight blocks, like dd would output, but with point-in-time metadata in between or in a header? Or is the main data transcoded in some way? … Read more

Azure Linux based VM could not start. Internal server error

We have our own Linux based distribution for which we created a .vhd file from .iso using VirtualBox. We uploaded the .vhd to Azure following the instructions given here: https://azure.microsoft.com/en-us/documentation/articles/virtual-machines-linux-create-upload-vhd/ Then, we created a VM using this image, but when trying to start the VM, it fails. It gives the following error: ‘The server encountered … Read more

How to troubleshoot Azure with custom Debian VHD; error message “provisioning failed”?

I have built a customised Debian (Jessie/8) VHD which I am trying to get running on Azure. According to my research (and the MS docs I’ve read) it meets the Azure Linux VHD requirements. I have tried to err on the side of caution to reduce or eliminate possible causes of issue. Here’s some general … Read more

User profiles as VHDX files – paging operation errors

Hello we have this terminal server on w2k12. Users login and have their profile mounted as virtual disk from VHDX file with filename like this C:\Users\Public\Documents\RDS_UserProfileDisks\UVHD-S-1-5-21-3626241538-2602771230-459845379-52949.vhdx I can see these as “user disk” with blue icons in disk management. We started to get incidents from our monitoring related to eventlogs An error was detected on … Read more