[virt-tools-list] backing file contents

[Richard W.M. Jones]

On Fri, Jun 03, 2011 at 09:46:07AM +0100, Richard W.M. Jones wrote:
> On Thu, Jun 02, 2011 at 10:10:08PM -0400, Gary Scarborough wrote:
> > Would it be possible to examine the contents of a backing file?  For
> > instance, if I created a backing file for a win xp guest, could I generate a
> > group of files that had been changed since the backing file was created?  I
> > would like to be bale to track differences in the file system over time.

By the way, since this is Windows, you might also be interested in
Windows registry changes.  It's best to use a tool like hivex that
understands the registry, rather than treating the registry as an
opaque file blob.  With virt-win-reg this is relatively easy.

For each registry hive of interest, do:

  virt-win-reg /path/to/backing-file 'HKLM\SYSTEM' > /tmp/system.old
  virt-win-reg /path/to/win-xp 'HKLM\SYSTEM' > /tmp/system.new
  diff -u /tmp/system.old /tmp/system.new

You have to do this operation separately for each hive (see [1]).

Rich.

[1] http://libguestfs.org/virt-win-reg.1.html#supported_systems

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-top is 'top' for virtual machines.  Tiny program with many
powerful monitoring features, net stats, disk stats, logging, etc.
http://et.redhat.com/~rjones/virt-top