ESXi: shrinking a Windows disk
Posted by jpluimers on 2020/09/04
I had to shrink down a Windows disk of an ESXi based Virtual Machine from 240 Gibibyte to about 140 gigabyte.
In this case, it was Windows 7 on ESXi 6.5, but the actual versions do not really matter.
The only way to decrease ESXi .vmdk files is by fiddling with disk sector counts in the text based .vmdk files (not the binaries .vmdk files!) of a diskname.vmdk / diskname-flat.vmdk text/binary pair. This is described for instance in these two articles:
- [WayBack] How to Shrink a VMDK file in ESX – vBrownBag
# Extent description
RW 52428800 VMFS "foo-flat.vmdk"The value between
RWandVMFSis the size of disk in sectors.After changing the value, you can use
vmkfstoolsto clone this disk. - [WayBack] Shrink a VMDK with VMKFSTOOLS – Bonus Bits has a more step by step approach of the above link.
Notes:
- This article presumes you already shrunk your NTFS partition (for instance as described in Consolidating NTFS free space).
- If you only have a binary .vmdk file, then you can use
vmkfstoolsto create a text/binary pair for you, for instance by using these commands:
vmkfstools --clonevirtualdisk Windows7.vmdk Windows7.thick.vmdk
vmkfstools --clonevirtualdisk Windows7.vmdk Windows7.thin.vmdk --diskformat thin- You cannot workaround 2. as the
--geometryfunctionality ofvmkfstoolsonly displays existing geometry, see
ESXi has .vmdk files that count disk sizes in sectors, but the tooling that ship with Windows to not show partition sizes in sectors, especially not the partition ending sector.
All permutations of tooling like DISKPART, PowerShell, WMIC and terms partition, ending sector, cylinder, head, etc failed me to return built-in tools.
Luckily, “powershell” “partition” “ending sector” found the documentation for [WayBack] Test Disk | File System | Data Management titled “TestDisk Documentation, Release 7.1, Christophe GRENIER” which lead to:
[WayBack] TestDisk Download – CGSecurity
Download TestDisk & PhotoRec. TestDisk is a free and open source data recovery software tool designed to recover lost partition and unerase deleted files. PhotoRec is a file carver data recovery software tool.
It is available for many platforms, including Windows x86 (fully featured) and x64 (limited features):
- [WayBack] https://www.cgsecurity.org/testdisk-7.0.win.zip (stable)
- [WayBack] http://www.cgsecurity.org/testdisk-7.1-WIP.win.zip (work in progress)
There was also the much more convoluted PowerForensics which is also more difficult to install:
- [WayBack] Invoke-IR | PowerShell Digital Forensics and Incident Response: On the Forensic Trail – Master Boot Record (MBR)
- [WayBack] GitHub – Invoke-IR/PowerForensics: PowerForensics provides an all in one platform for live disk forensic analysis
- [WayBack] Invoke-IR | PowerShell Digital Forensics and Incident Response: Installing PowerForensics
As a check (because the calculations by hand are too cumbersome to trust on a first trey), I also downloaded the ISO image of gparted:
- [WayBack] GParted — Download
- http://downloads.sourceforge.net/gparted/gparted-live-0.31.0-1-i686.iso
- http://downloads.sourceforge.net/gparted/gparted-live-0.31.0-1-amd64.iso
Let’s get started for real!
Running TestDisk is easy
- Start it with UAC confirmation:
- Create the log file (which at first is in memory):
- Select the unix based disk (so do NOT start with drive C: as we are after physical disks, not logical drives):
- Windows drivers have an Intel/PC partition table, so select the first:
- Now you see which partitions are on the disk, and where (at which ending cylinder/head/sector) it ends:
- Now you can do the multiplication math from ending cylinder/head/sector to sector count: (17463 * 255 * 63) + (34 * 63) + 43 =
280545280- the first part is the ending cylinder number (17463) multiplied by heads per disk count (255) and sectors per cylinder count (63).
- the second part is the ending head number (34) times sectors per cylinder count (63)
- the third part is the ending cylinder number (43)
This is all very cumbersome, so let’s verify this
Running gparted
Booting from CD-ROM requires a boot delay (longer than the default of 0 milliseconds):
That way you can press Esc during boot to get into the boot-order menu, and change it to CD-ROM boot:
Too bad the gParted people choose a psychedelic background bleed:
Anyway: here are the steps in gParted to get the sector counts:
- Use the default keyboard layout:
- Keep default language:
- Keep default video settings:
- Select the lowest partition (the “unallocated” one):
- Now in the menu, choose “Partion”, then “Information:
- The first sector of the unallocated partition is 1 sector beyond the last used partition
280545280versus280545279which matches the one we found:
Another example
(5112 * 255 * 63) + (40 * 63) + 48 =
82126848
–jeroen
The Wiert Corner - irregular stream of stuff 
Leave a Reply