How to view live file system of QEMU/KVM VM externally?

I require to view the file system of a QEMU/KVM (with virt-manager as a GUI) Ubuntu VM with live updates to the information. Though I require to view this information externally from the VM (in the host). That is it would not be practice to view it from within the VM, but rather the host. Is there any way of doing this? The host and guest will both be Ubuntu GNOME 16.10 with GNOME 3.22.

Although as this is for the purposes of penetration testing the guest may vary, although it is likely only between Ubuntu flavours.

1 Answer

When in virt-manager you may find the path to the respective file in the configuration of the VM/disk (something like "source path"); default path is /var/lib/libvirt/images/. Find out the name of the image of the virtual disk.

Let's say the image path is /var/lib/libvirt/images/disk1.qcow2 (I suppose qcow2 format here).

First, install libguestfs-tools on the host:

sudo apt-get install libguestfs-tools

You can then mount the virtual disk by

sudo guestmount -a <image-file> -m <device> --ro /mnt

where <image-file> means the full path to the disk image and <device> the device name of the partition to mount. If you don't know the device name, you can give any name to list the valid devices, e.g.

sudo guestmount -a /var/lib/libvirt/images/disk1.qcow2 -m any --ro /mnt

This will give you something like

libguestfs: error: mount_options: mount_options_stub: any: expecting a device name guestmount: 'any' could not be mounted. guestmount: Did you mean to mount one of these filesystems? guestmount: /dev/sda1 (ext2) guestmount: /dev/sda2 (ext2) 

To mount the first partition you have then to issue

sudo guestmount -a /var/lib/libvirt/images/disk1.qcow2 -m /dev/sda1 --ro /mnt

Now you can access the filesystem in read-only mode in /mnt.

Important: When mounting a disk of a running VM this way you must specify "--ro" which means read-only, otherwise the filesystem may be damaged.

Instead of using the name of the virtualdisk file you may enter the name of the virtual domain, if there are more than one disk. Let's say your virtual domain's name is myvm, you may issue

sudo guestmount -d myvm -m any --ro /mnt

what will give you something like

guestmount: 'any' could not be mounted. guestmount: Did you mean to mount one of these filesystems? guestmount: /dev/sdb (iso9660) guestmount: /dev/sda1 (ext4) guestmount: /dev/sda2 (unknown) guestmount: /dev/sda5 (swap) guestmount: /dev/sdc1 (ext4) guestmount: /dev/sdc2 (unknown) guestmount: /dev/sdc5 (swap) guestmount: /dev/sdd1 (ext2) guestmount: /dev/sdd2 (ext2) 

so now to mount /dev/sdc1 (seen from your VM's view) you can issue

sudo guestmount -d myvm -m /dev/sdc1 --ro /mnt

This should do the trick.