Get Files Out of a Running Virtual Machine

Recently, I needed to copy some files out of a virtual machine – which I did not want to connect to the network.  After giving this some thought I realized that this would be trivially easy to do on Windows 8 / Windows 2012.  In fact – I could do it with a single line of PowerShell:

Get-VM “Test VM” | Checkpoint-VM -SnapshotName “Need to look at these disks” -Passthru | %{Get-VHD -VMId $_.vmid} | %{Mount-VHD $_.ParentPath -ReadOnly -Passthru} | Get-Disk | Get-Partition | Get-Volume

What this command does is:

  1. Create a new snapshot on the virtual machine (in this case I have called the snapshot “Need to look at these disks”
  2. Get the virtual hard disks that are associated with the snapshot
  3. Find the parent virtual hard disks and mount them read only
  4. Tell me the drive letters that have been assigned

I can now happily copy out any files I need – while the virtual machine continues to run. When I am done – I can clean things up with another line of PowerShell:

Get-VMSnapshot -VMName “Test VM” -Name “Need to look at these disks” | %{Get-VHD -VMId $_.vmid} | %{Dismount-VHD $_.ParentPath} ; Remove-VMSnapshot -VMName “Test VM” -Name “Need to look at these disks”

This command:

  1. Finds the snapshot I created with the first command
  2. Finds the virtual hard disks (again)
  3. Dismounts the parent virtual hard disks
  4. Deletes the snapshot that I created

And now the virtual machine is back to where it started.

Running in a PowerShell session – this simply looks like this:


Very handy.