Digital Forensics & Incident Response
  • Welcome
  • General Notes
    • Azure Blob storage with NGINX proxy
    • Install and Configure ZeroTier client
    • S3FS Fuse and MinIO
    • Enable nested VT-X/AMD-V
    • mitm proxy
    • Exploring Volume Shadow Copies Manually
    • Resize VMDK/VDI
    • Resize VMDK on ESXi
    • Convert raw to vmdk
    • Favicon hashing and hunting with Shodan
    • WinRM/RemotePS
    • MinIO/S3/R2 ghost files
    • Mount E01 containing VMDK/XFS from RHEL system
    • Disk images for various filesystems and configurations
      • ext4 with LVM and RAID5 (3 disks)
      • ZFS
      • UFS, FFS, BTRFS, XFS
      • ext4, LVM, and LUKS1/LUKS2
      • NTFS, FAT32, with BitLocker
      • NTFS, FAT32, exFAT with TrueCrypt, VeraCrypt
    • VirtualBox adapters greyed out
    • Exporting SQLite blob data from standalone SQLite database using command line tools
  • Microsoft Defender KQL
    • Introduction to KQL
  • Windows Forensics
    • PsExec
      • PsExec and NTUSER data
    • Security Patch/KB Install Date
  • Linux Forensics
    • Inspecting RPM/DEB packages
    • Common Locations
  • ESXi Forensics
    • Mount external USB device in ESXi hypervisor
    • Understanding ESXi
      • Partitions / Volumes
      • ESXi console / shell
      • Guest Virtual Machines
    • General Notes
    • Triage and Imaging
    • ESXi VMFS Exploration
    • Export OVF from ESXi using OVF Tool
    • Identification, acquisition, and examination of iSCSI LUNs and VMFS datastores
  • Memory Forensics
    • Volatility
      • Volatility3 core commands
      • Build Custom Linux Profile for Volatility
      • Generate custom profile using btf2json
      • Banners, isfinfo, and custom profiles
      • Volatility2 core commands
      • 3rd Party Plugins
    • Acquisition
      • ESXi / VMware Workstation snapshots
      • DumpIt
      • WinPMem
      • Linux / AVML
  • Incident Response
    • Ivanti Connect Secure Auth Bypass and Remote Code Authentication CVE-2024-21887
    • VirusTotal & hash lists
    • Unix-like Artifacts Collector (UAC)
      • Setup MinIO (object storage)
      • Create S3 pre-signed URL
      • UAC and pre-signed URLs
    • Acquiring Linux VPS via SSH
    • AVML dump to SMB / AWS
    • China Chopper webshell
    • Logging Powershell activities
    • Compromised UniFi Controller
    • AnyDesk Remote Access
    • Mounting UFS VMDK from NetScaler/Citrix ADC
  • iOS Forensics
    • Checkm8 / checkra1n acquisitions/extractions
  • CTF / Challenges
    • 13Cubed Linux memory forensics
    • Compromised Windows Server 2022 (simulation)
      • FTK Imager
      • Autopsy Forensics
      • Plaso
      • Events Ripper
      • EZ tools
    • DEFCON 2019 forensics
    • Tomcat shells
    • Magnet Weekly CTF
      • Magnet CTF Week 0
      • Magnet CTF Week 1
    • DFIR Madness CTF
      • Case 001 - Szechuan Sauce
  • Log Files
    • Windows
      • Generating Log Timelines
  • Malware Analysis
    • Identifying UPX packed ELF, decompressing, fixing, and analysing Linux malware
    • PDF Analysis
  • Walking the VAD tree
  • OpenCTI
    • What is CTI/OpenCTI?
    • Setting up OpenCTI
    • Container Management
    • Configure Connectors
  • Vulnerability Management
    • Setting Up Nessus (Essentials)
    • Troubleshooting
  • Privacy
Powered by GitBook
On this page

Was this helpful?

  1. ESXi Forensics

Mount external USB device in ESXi hypervisor

How to mount an external USB drive in an ESXi hypervisor for host access. I highly recommend using a new, large disk (depending on your requirements) which will be formatted using VMFS/VMFS6.

  1. Stop USB service

[root@esxi:~] /etc/init.d/usbarbitrator stop
watchdog-usbarbitrator[2101796]: Terminating watchdog process with PID 2098419
stopping usbarbitrator...
usbarbitrator stopped
  1. Connect external USB drive to ESXi host (in this example we're using a 32GB SanDisk USB)

[root@esxi:~] vdq -q
      "Name"     : "mpx.vmhba35:C0:T0:L0",
      "VSANUUID" : "",
      "State"    : "Ineligible for use by VSAN",
      "Reason"   : "Has partitions",
      "IsSSD"    : "0",
"IsCapacityFlash": "0",
      "IsPDL"    : "0",
      "Size(MB)" : "29340",
    "FormatType" : "512n",
   "IsVsanDirectDisk" : "0"
   }
  1. Format entire external drive using vmkfstools

[root@esxi:~] vmkfstools -C vmfs6 -S MyVolume /dev/disks/mpx.vmhba35:C0:T0:L0:1
create fs deviceName:'/dev/disks/mpx.vmhba35:C0:T0:L0:1', fsShortName:'vmfs6', fsName:'MyVolume'
deviceFullPath:/dev/disks/mpx.vmhba35:C0:T0:L0:1 deviceFile:mpx.vmhba35:C0:T0:L0:1
ATS on device /dev/disks/mpx.vmhba35:C0:T0:L0:1: not supported
.
Checking if remote hosts are using this device as a valid file system. This may take a few seconds...
Scanning for VMFS-6 host activity (4096 bytes/HB, 1024 HBs).
Creating vmfs6 file system on "mpx.vmhba35:C0:T0:L0:1" with blockSize 1048576, unmapGranularity 1048576, unmapPriority default and volume label "MyVolume".
Successfully created new volume: 66909728-dd72c566-8a2f-3cecef04e91c
  1. Check volume is mounted and accessible

[root@esxi:~] ls -lah /vmfs/volumes/
<snip>
lrwxr-xr-x    1 root     root          35 Jul 12 02:39 MyVolume -> 66909728-dd72c566-8a2f-3cecef04e91c
  1. Check you can read/write to mounted volume

[root@esxi:~] echo "32GB" > /vmfs/volumes/MyVolume/something.txt
[root@esxi:~] cat /vmfs/volumes/MyVolume/something.txt
32GB

Note: if you receive an error similar to the following, you need to specify the actual partition you're intending to format (mpx.vmhba35:C0:T0:L0:1 instead of mpx.vmhba35:C0:T0:L0)

Failed to create VMFS on device mpx.vmhba35:C0:T0:L0
/dev/disks/mpx.vmhba35:C0:T0:L0: Permission denied.  (Have you set the partition type to 0xfb?)
Error: Permission denied
PreviousCommon LocationsNextUnderstanding ESXi

Last updated 11 months ago

Was this helpful?

To mount your VMFS volume/disk on Linux, read this

https://www.iblue.team/esxi-forensics/esxi-vmfs-exploration