$ export LD_LIBRARY_PATH=”/opt/virtualbox”

$ vditool DD win.vdi win-raw.bin

$ vditool SHRINK win.vdi

Dumping VDI image file=”NTFS.vdi” into the log file…
Log created: 2008-06-26T07:23:24.202875000Z
Executable: /public/bin/vditool
Arg[0]: vditool
Arg[1]: DUMP
Arg[2]: NTFS.vdi
— Dumping VDI Disk, Images=1
Dumping VDI image “NTFS.vdi” mode=r/o fOpen=1 File=00000003
Header: Version=00010001 Type=2 Flags=0 Size=2147483648
Header: cbBlock=1048576 cbBlockExtra=0 cBlocks=2048 cBlocksAllocated=2048
Header: offBlocks=512 offData=8704
Header: Geometry: C/H/S=520/128/63 cbSec×=512
Header: uuidCreation={2f6d1089-800d-4489-e596-646722a2f13d}
Header: uuidModification={19664572-879b-459f-539e-b52a2af62469}
Header: uuidParent={00000000-0000-0000-0000-000000000000}
Header: uuidParentModification={00000000-0000-0000-0000-000000000000}
Image:  fFlags=00000000 offStartBlocks=512 offStartData=8704
Image:  uBlockMask=000FFFFF uShiftIndex2Offset=20 uShiftOffset2Index=20 offStartBlockData=0
The operation completed successfully!

Type=1 ：动态大小 (不能挂载)

Type=2：固定大小(可以挂载)

offData=8704：数据区偏移

跳过MBR，数据从 8704+63*512 = 40960 开始

$ sudo mount -t ntfs-3g -o rw,noatime,noexec,loop,offset=40960 NTFS.vdi /mnt/ef

挂载的是实际的“磁盘”，不包含快照。