[virt-tools-list] backing file contents

[Richard W.M. Jones]

On Thu, Jun 02, 2011 at 10:10:08PM -0400, Gary Scarborough wrote:
> Would it be possible to examine the contents of a backing file?  For
> instance, if I created a backing file for a win xp guest, could I generate a
> group of files that had been changed since the backing file was created?  I
> would like to be bale to track differences in the file system over time.

It's sort of possible to do this using libguestfs, although it's not
very easy [at the moment -- it would be nice to make this easier].

To get a simple list of filename differences you could do this:

  guestfish --ro -i -a /path/to/backing-file \
    find0 / - | tr '\0' '\n' | sort > /tmp/files.old

  guestfish --ro -i -a /path/to/win-xp \
    find0 / - | tr '\0' '\n' | sort > /tmp/files.new

  diff -u /tmp/files.old /tmp/files.new | less

(Reference:
http://libguestfs.org/guestfs-recipes.1.html#list_files_and_directories_in_a_vm )

To get changes of file content, file size, permissions etc is a bit
more complicated.  At this point you would probably be best to write a
program that visits each file, following this example:

https://rwmj.wordpress.com/2010/12/15/tip-audit-virtual-machine-for-setuid-files/

Another way would be to export the complete contents of both
filesystems as tarballs, leaving you with the separate problem of
comparing two tarballs that maybe can be solved with other tools:

http://libguestfs.org/guestfs-recipes.1.html#export_any_directory_from_a_vm

By the way, I didn't test any of the above with actual backing files.
If you find problems, let me know and I will set up and test an
equivalent system here.

Also this assumes that your backing file is a consistent filesystem
image.  This would normally be the case, but I guess it is possible to
do strange things with backing files.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
libguestfs lets you edit virtual machines.  Supports shell scripting,
bindings from many languages.  http://libguestfs.org