Pure-Rust read-only VHDX container reader — dynamic, fixed, differencing, and dirty-log recovery.

Decodes the Microsoft VHDX container format (Hyper-V, Windows 8+, WSL2, Azure) and exposes a Read + Seek interface over the virtual sector stream. Replays dirty logs automatically on open and supports differencing-disk parent chains — zero unsafe code, no C bindings, no external tools required.

[dependencies]
vhdx = "0.1"

---

Usage

Open a VHDX and read sectors

use vhdx::VhdxReader;
use std::io::{Read, Seek, SeekFrom};

let mut reader = VhdxReader::open("disk.vhdx")?;

println!("Virtual disk size: {} bytes", reader.virtual_disk_size());
println!("Logical sector size: {} bytes", reader.logical_sector_size());

// Read the first sector
let mut sector = vec![0u8; reader.logical_sector_size() as usize];
reader.seek(SeekFrom::Start(0))?;
reader.read_exact(&mut sector)?;

Pass to a filesystem crate

VhdxReader implements Read + Seek, so it drops directly into any crate that accepts a reader:

use vhdx::VhdxReader;

let reader = VhdxReader::open("disk.vhdx")?;
// e.g. ext4fs_forensic::Filesystem::open(reader)?;

Read from an in-memory buffer

use vhdx::VhdxReader;

let data: Vec<u8> = std::fs::read("disk.vhdx")?;
let reader = VhdxReader::from_bytes(data)?;

Open a differencing (child) disk with its parent

use vhdx::VhdxReader;

let parent = VhdxReader::from_bytes(std::fs::read("base.vhdx")?)?;
let reader = VhdxReader::from_bytes_with_parent(std::fs::read("child.vhdx")?, parent)?;
// Reads absent blocks in the child are transparently served from parent.

---

CLI

The vhdx-cli crate (included in this workspace) provides a vhdx info command:

$ vhdx info disk.vhdx
File:              disk.vhdx
Format:            VHDX v1 (dynamic)
Virtual disk size: 16,777,216 bytes (16.00 MiB)
Logical sectors:   512 bytes

---

Supported formats

Format	Supported
VHDX Version 1 (Windows 8 / Server 2012+)	✓
Dynamic disks (sparse, BAT-addressed)	✓
Fixed disks (pre-allocated)	✓
Differencing disks (single-level parent chain)	✓
Log replay (dirty-log recovery)	✓

Read-only. Differencing disks require the parent image to be supplied via VhdxReader::from_bytes_with_parent. Log replay is applied automatically on open when the active header carries a non-zero LogGuid.

---

Related crates

Crate	Role
vhdx-forensic	Forensic integrity analyser and in-memory repair tool built on this crate
ewf	Equivalent reader for E01/EWF forensic disk images
ewf-forensic	Forensic analyser for E01 images

---

Privacy Policy · Terms of Service · © 2026 Security Ronin Ltd