Recover VM

Discussions related to using VirtualBox on Windows hosts.
Post Reply
salvipor
Posts: 3
Joined: 31. Jul 2022, 10:34

Recover VM

Post by salvipor »

Good morning,
Thanks first for the help, I have a problem with my VM; by mistake we deleted files from the SnapShot folder, leaving the last (most recent) one, with size equal to the initial VDi file. Now when we try to open the VM it tells us that files are missing. Is there any way to recover the VM or at least the data contained in the machine? The SnapShots were created by VirtualBox. If I create a new one with the VDi it creates it with the initial configuration without data.
Thank you very much, regards
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Recover VM

Post by mpack »

A snapshot VDI is not a separate "file cabinet" as many people think. Instead it contains instructions on how to patch the previous image at the disk sector level in order to advance the disk image to the modified state. Suppose your snapshot chain was this:

<base> + <A> + <B> + <C> + <D>

Where <base> is the VDI originally created with the VM, and A,B,C are subsequent snapshot VDIs. Note that whenever a new snapshot is created the existing files are frozen and never written to again - so you must NOT mount any of them in an another VM if you hope to get anything back.

Deleting any of these VDI files causes unrecoverable data loss (unless you had a backup of the missing file). The exact amont of data loss depends on which file you deleted. Data can only be retrieved if you can form a complete unbroken chain as above. So if you deleted <D> then you can still form a chain from <base> to <C> and recover a lot of data. However if you deleted <A> then the longest valid chain you can create is <base> on its own, and that's all the data you can recover. If you deleted <base> then the whole lot is gone forever.

Short version: experienced users make backups, snapshots are not used much if at all.
salvipor
Posts: 3
Joined: 31. Jul 2022, 10:34

Re: Recover VM

Post by salvipor »

OK, thank you very much.
I was exporting my VM, the hard disk was full, and I suppose some files were deleted.
My VM had 8 snapshots (base=A+B+C+D+E+F+H+G), and I haven't 4 (B, D,E,F).
If I can't restart my VM, do you know if I can extract some files/folders? I will create a new VM, but I need thoose files.
Thanks again for your reply
mpack
Site Moderator
Posts: 39156
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Mostly XP

Re: Recover VM

Post by mpack »

As I said, snapshots are difference chains at a sector level, not a file level, so it isn't possible to extract files from snapshots. In essence each snapshot is just a fragment, it doesn't even include complete directories. You need to form a complete chain to make one disk image. Different length chains give you different versions of image separated in time, but gaps in the chain are not allowed.

Since you deleted B, the longest intact chain you can make is <base>+A.

For the truly desperate you can try hacking the UUID links between snapshot VDIs (make backups first of course), but I have only ever seen this done when only a single snapshot was deleted, and it didn't contain much.

See viewtopic.php?f=6&t=99852.
Or viewtopic.php?f=7&t=105466 (contains practical example).

Your original post mentions that the newest snapshot is about the same size as <base>. In that case there may be a good chance that the UUID hack will work.
salvipor wrote: I was exporting my VM, the hard disk was full, and I suppose some files were deleted.
I don't understand what this means. Exporting a VM creates a copy, it does not cause parts of the original VM to be deleted. If you export a VM then all of the snapshot info is discarded (from the copy) and the OVA will contain a merged VMDK - if you have that then that's ideal, you will have lost nothing. Just import it again. If what you mean is that you copied (not exported) the VM files to an external drive, and then deleted the VM from the source drive before checking the copy... well yes, that would certainly do it. A classic version of this would be to copy all files to a FAT-formatted external drive, which would cause all files larger than 4GB to be lost, as FAT does not support larger files. There would have been error messages however.
salvipor
Posts: 3
Joined: 31. Jul 2022, 10:34

Re: Recover VM

Post by salvipor »

Thank you very much again,
I was exporting the VM and it filled up the hard disk, giving error the export; the .OVA is 2Gb (win10.vdi 38,5Gb and the latest SnapShot 38,2Gb), if I try to import the OVA it gives error.
When I freed up disk space, in the SnapShot folder there were only these 4 files, but VirtualBox tells me that 4 more are missing.
I'm going to try some options in Linux to try to extract data from a VDI (sudo apt-get install qemu-kvm
sudo modprobe nbd
sudo qemu-nbd -c /dev/nbd0 /home/david/VirtualBoxes/VMs/ubuserver/ubuserver.vdi
sudo mount /dev/nbd0p1 /home/david/backup
).
I will also try to copy those 4 missing VIDs, and assign the UUID of the previous ones,
Thanks a lot. If you can think of anything else to recover the data, I would really appreciate it.
Post Reply