xva-image is a tool to generate disk images from Citrix XenServer .xva
VM images as well as to generate .xva VM images from raw disks and the
according ova.xml files.
.
It's for example needed if you want to forensically analyse a virtual
machine in .xva format on a non-Citrix operating system.
.
Citrix Xen uses a custom virtual appliance format for import/export
called "XVA". it's basically a strangely crafted tar-file. You don't
need this program to unpack this tar-file, just use your favourite tar
unpacker (tar, gtar, bsdtar). Once unpacked you will end up with a lot
of different files, ova.xml (which contains the settings for the virtual
appliance, think VMware vmx) and a number of folders called Ref:<number>/,
this is your disks. Each of these folders contain hundreds of files named
00000000, 00000001 with a accompanying .CHECKSUM file (SHA1).
Each file is a 1MB slice of the disk, but some of the files in the sequence
will probably be missing this is because XVA do not use compression; instead
it will exclude slices of the disk that only contains zeros (are empty).
This tool can assemble the disk for you (you will end up with a RAW disk)
that can easily be mounted and modified. It can then also split the file again
and generate checksum. Once ready, you will probably want to use the "package"
command to rebuild the XVA file.
