3 virt-bmap - construct a map of disk blocks to files and display files accessed by a guest on boot
7 virt-bmap [-o bmap] [--format raw|qcow2|...] disk.img
9 nbdkit -f bmaplogger file=disk.img [bmap=bmap] [logfile=logfile] \
10 --run ' qemu-kvm -m 2048 -hda $nbd '
14 Virt-bmap is two tools that help you to discover where files and other
15 objects are really located within a virtual machine disk image, and to
16 observe what files a virtual machine accesses when it boots.
18 =head2 virt-bmap: Construct block map from disk image
20 The C<virt-bmap> program takes a disk image, examines it looking for
21 files, directories, partitions and other significant features, and
22 constructs a block map of disk offsets to files. Use it like this:
24 virt-bmap --format raw disk.img
26 =head2 Output block map file
28 The output block map (default name: C<bmap>) is a simple text file
29 which maps disk ranges to files.
31 The mapping is not 1-1. It is possible for multiple files to appear
32 to be mapped to a single disk range, or for disk ranges not to
33 correspond to any object.
35 1 541400 544400 d /dev/sda1 /lost+found
36 1 941000 941400 f /dev/sda1 /.vmlinuz-3.11.10-301.fc20.x86_64.hmac
37 1 941400 961800 f /dev/sda1 /config-3.11.10-301.fc20.x86_64
38 1 961800 995400 f /dev/sda1 /initrd-plymouth.img
40 The first four columns are:
46 the disk image index (always C<1> in the current implementation),
50 the starting byte offset,
54 the ending byte offset + 1
72 (lowercase L) logical volume
86 The following column(s) identify the file or object.
88 =head2 bmaplogger: nbdkit plugin to observe file accesses
90 The second tool is an L<nbdkit(1)> plugin called C<bmaplogger>. Use
91 this in conjunction with "captive nbdkit" (see L<nbdkit(1)>) to
92 observe the files accessed by a virtual machine when booting:
94 nbdkit -f bmaplogger file=disk.img bmap=bmap \
95 --run ' qemu-kvm -m 2048 -hda $nbd '
97 =head1 VIRT-BMAP OPTIONS
101 =item B<-f> raw|qcow|...
103 =item B<--format> raw|qcow|...
105 Set the format of the input disk image. The default is C<raw>.
107 Note this is I<not> auto-detected, you I<have to> specify the
112 Display brief help message and exit.
116 =item B<--output> FILENAME
118 Write the output (block map) to the named file. The default is a file
119 called C<bmap> in the current directory.
125 Display version number and exit.
129 =head1 BMAPLOGGER OPTIONS
131 This section documents the bmaplogger plugin options. For general
132 nbdkit options see L<nbdkit(1)>.
136 =item B<file=>disk.img
144 (Optional: defaults to C<bmap>)
146 The block map, previously prepared using C<virt-bmap>, and
147 corresponding to the same disk image specified in C<file=...>
149 =item B<logfile=>FILENAME
151 (Optional: defaults to stdout)
153 Send the log output to a file.
162 L<http://libguestfs.org/>,
163 L<http://www.redhat.com/mailman/listinfo/virt-tools-list>
167 Richard W.M. Jones <rjones @ redhat . com>
171 (C) Copyright 2014 Red Hat Inc.
173 This program is free software; you can redistribute it and/or modify
174 it under the terms of the GNU General Public License as published by
175 the Free Software Foundation; either version 2 of the License, or
176 (at your option) any later version.
178 This program is distributed in the hope that it will be useful,
179 but WITHOUT ANY WARRANTY; without even the implied warranty of
180 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
181 GNU General Public License for more details.
183 You should have received a copy of the GNU General Public License
184 along with this program; if not, write to the Free Software
185 Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.