Restore data from Snapshot/UUID.vdi when base/main.vdi is lost

[Bucoflex]

Im more or less noob when it comes to virtual machines. Im new in this business so im seeking answer from you guys.

Im just wondering if there is any chance to restore data from only {UUID}.vdi when main.vdi is deleted. My UUID.vdi is 800GB big.

Thank you.

[scottgus1]

The only way to get your VM going is to restore the main.vdi from your backups.

A snapshot vdi is not sufficient to recover data. (Though you might find some usable data by hunting through the snapshot vdi with a hex editor.) The snapshot data requires the main vdi to be usable.

[mpack]

A snapshot (a.k.a. difference image) is effectively a patch script telling how to modify the parent vdi to obtain an updated disk image. The patch list is useless without a copy of the thing to be patched.

[fth0]

AFAIU, in theory, a tool could be developed (or CloneVDI could be extended) to create a new base VDI file, where all the missing data blocks are filled with zeroes. But the resulting VDI probably wouldn't contain a usable file system then, and could only be used together with data rescue tools.

[mpack]

If the goal is to produce a raw file with no usable filesystem then there is no need for any processing - just grab what you can find from the snapshot file (*). Which will be very little, since it's just a jumble of randomly ordered 1MB blocks rather than files. Identifying and making practical use of the contents of each block would be a difficult task, to put it mildly.

And all assuming of course that the user didn't shoot himself in the feet with other useful tools, such as encryption.

(*) If you want to access it as a drive from a VM then just rename it to "xxx.raw" and use "VBoxManage internalcommands createrawvmdk" to create a VMDK descriptor. Ignore the first 2MB of the raw image containing the snapshot header and blockmap (3MB for VDI capacities larger than 256GB).

[fth0]

Personally, I'd prefer to preserve the existing VDI block map information (*): When the resulting VDI file(s) would be attached as an additional hard drive image to a VM, good data rescue software would see the "original" hard disk, with the ordering of the 1 MB blocks intact, with "some" (**) overwritten clusters/sectors, and could use its heuristics regarding the typical cluster/sector usage patterns of known file systems.

(*) Either by creating a new base VDI image containing an appropriately modified copy of the VDI header of the differencing image and a VDI block map full of zero-block markers, or by patching (a copy of) the differencing image accordingly.

(**) With larger differencing images (like the 800 GB one here), there is even some chance that the majority of 1 MB blocks is available.

My suggestion was only meant as a general idea for the future, should you ever get bored. No immediate action required.