[Solved] Can't attach virtual disk file after crash VirtualBox

[Tim85]

Hello,

In accordance to the "Minimum information needed for assistance" described in the rules and FAQ, I have listed the required info at the beginning of my post.

VirtualBox Version 5.1.30 r118389 (PUEL)
Extension Pack 5.1.12 r112440 installed
Host: Windows 10 Home 64 bit with 12 Gb of RAM
Guest: Windows 7 Pro 32 bit with 4 Gb of RAM

Since my backup seemed to be only partial and I really would like to recover the missing data, I have already put some effort in it. This is what I tried so far.

I have searched the forum but this did not deliver the answer to my question: How to recover files from a .vdi which can't be attached to a virtual machine ?

About a month ago my virtual machine suddenly crashed due to "time-out" after being idle for some time (on screensaver). Since the 'Oracle VM VirtualBox Manager' (GUI) labeled the .vdi as "not approachable" [screenshot 1. Prt scr settings] I created a new virtual machine and tried to attach the .vdi to this new machine. Unfortunately this gave me an error message [screenshot 2. Attach .vdi to another virtual machine] telling me the .vdi could not be opened.

I have searched the forum and looked the error up on Google, but since I'm not an IT-pro I honestly don't understand what the error means. So I hope somebody on this forum can help me to recover the files inside the .vdi which I can no longer attach to a virtual machine.

Below you can find the links to the pages of the forum I have read. I have given my best effort to carry out the described steps. Sadly none of them were successfull.
* viewtopic.php?f=6&t=45192
* viewtopic.php?f=1&t=40066
* viewtopic.php?f=6&t=44654
* https://www.virtualbox.org/ticket/4735

Following my search on Google, I also tried to view the contents of a copy of the original .vdi file using the programs below. Only "Hetman Partition Recovery" could open the copy of the original .vdi file, but a lot of content was missing.
* Deamon Tools Lite
* File View Pro
* Gizmo Central
* PartitionGuru
* PowerISO
* SysInfo Tools VDI Recovery
* BitRecover VDI Recovery Wizard + BitRecover Virtual Drive Recovery Wizard
* Hetman Partition Recovery
* ImDIsk Virtual Disk Driver
* Stellar Phoenix Virtual machine Data Recovery
* WinMount
* 7-Zip
* mounting the .vdi through the Windows Disk Management (directly on my host and inside another virtual machine running Windows 7 pro)

I have attached the mentioned screenshots along with the log file of the original .vdi (combined in .ZIP-file).

Apologies for the long post.

Thanks a lot in advance.

Kind regards.

Tim
--

[mpack]

Try cloning the VDI using CloneVDI. If it can't repair the damage then nothing can. See the release notes (in the zip) for details of the repair feature.

Note: if CloneVDI can repair the damage then you should throw away "Hetman Partition Manager". If its validation is so poor that it will open garbage data without complaint then it can't be trusted to process any data correctly.

[Tim85]

Dear mpack,

Thank you for your quick reply.

As I come home late during the week, I can only try out the solution you have offered on Saturday. Hopefully, your latest version of CloneVDI will be able to save my virtual hard drive.

I will keep you informed.

Kind Regards.

Tim

[Tim85]

Try cloning the VDI using CloneVDI. If it can't repair the damage then nothing can. See the release notes (in the zip) for details of the repair feature.

Note: if CloneVDI can repair the damage then you should throw away "Hetman Partition Manager". If its validation is so poor that it will open garbage data without complaint then it can't be trusted to process any data correctly.

Dear mpack,

As suggested in your reply to my post I tried to copy my corrupted VDI using your CloneVDI (v3) tool. I have followed the instructions written in the release notes. On the 'home screen' of your tool my VDI was validated as "strange format or corrupted" {screenshot 1} so I clicked the repair button to proceed. This was followed by an expected error prompt (cfr. release notes) "cloning a corrupted source file" {screenshot 2} so I clicked the yes button to proceed. On its turn this prompt was followed by another one informing me there was not enough space on the destination drive {screenshot 3}. Strangely enough, however, there is twice as much space available as necessary on the destination drive {screenshot 4}.

Can you please tell me how much free disk space is needed to repair a VDI of 160 Gb ?

I have added all the mentioned screenshots in 1 ZIP-file.

Thanks in advance for your reply.

Kind regards.

Tim

[mpack]

I'm afraid that the "not enough space" error message probably implies that the block map is garbage and the VDI is not repairable.

If you like you can use a hex editor to save the first 3MB+1K of the file (precisely 3146752 bytes) to a binary file, zip it, and attach the zip here. If it's too large even after compression then you may need to host it elsewhere and provide a download link here. Either way I'll try to find time to have a look to see if it really can't be saved.

And to be absolutely clear: the reason you have not mentioned an "undelete" tool is because no such snake oil has been used, right? The output of such tools is almost always garbage when applied to files of this size.

[Tim85]

Dear mpack,

Thanks for your very quick reply. I can confirm there has been no undelete tool involved. When the virtual machine was running I had to leave my pc suddenly for about an hour (I guess) and when I got back I saw the machine had stopped working due to a "time-out". That's all that happened.

Following to your last reply I installed HxD - Hexeditor v 1.7.7.0 but I'm afraid I don't know how to use it. Can you please explain me how I can save only the first 3MB+1K (precisely 3146752 bytes) to a binary file ?

Your help is greatly appreciated.

Kind regards.

Tim

[mpack]

Topic moved to "Windows Hosts".

Following to your last reply I installed HxD - Hexeditor v 1.7.7.0 but I'm afraid I don't know how to use it. Can you please explain me how I can save only the first 3MB+1K (precisely 3146752 bytes) to a binary file ?

Having never heard of that tool, no I can't. The tool I use is called FrHed. In that tool I used "Open Partially" to open the first part of the file (at least equal to the number of bytes above). Then I select first NNN bytes and use File|Save selection as.

Perhaps your current tool has similar features. The only things necessary are a way to open files which are way larger than system RAM, and a way to write a portion to a binary file.

[Tim85]

Dear mpack,

Thanks for your reply. I will install the tool you mentionned this weekend so I can save the requested part of the file and upload it here.

Kind Regards.

Tim

[Tim85]

If you like you can use a hex editor to save the first 3MB+1K of the file (precisely 3146752 bytes) to a binary file, zip it, and attach the zip here.

Following to your previous post, I have installed FrHed and saved the first 3146752 bytes as explained by you to a binary file. You can find this zipped file as attachment to this post.

I would greatly appreciate it if you would like to take a look at it and post your opinion about its state (whether the contents of VDI can still be recovered or not)

Thanks in advance.

Kind regards.

Tim

[mpack]

I'm confused. Your description above says that CloneVDI gave error messages and you were therefore unable to clone and repair the VDI using CloneVDI.

However, the image you have provided is a CloneVDI created VDI image. Please explain.

Also, please tell me the exact size of this VDI file, in bytes.

The first entry in the block map is very strange. Have you previously resized this drive using VBoxManage? (not CloneVDI, the strange layout I'm seeing can only have been caused by an in place resize, and CloneVDI never does anything in place).

[mpack]

I've released a new version of CloneVDI to help with this fix, so please download it again and try it.

CloneVDI uses heuristics to recognize features of the VDI so it can synthesize a new header. The first block of your image was not being recognized as such by this heuristic, because somebody has moved your boot sector to some weird part of the disk which I don't have in that 3MB excerpt.

So, I've done what I can. Give it a go. I've no idea why the previous version would have resulted in a file size warning, it should simply have failed to start. Let's see what happens now.

[Tim85]

Dear mpack,

First of all the best wishes for the new year. Sorry for the late response and for the long post. As a result of the holidays, I have not been able to use my PCs so much.

The "problem" has been solved thanks to the latest version of your fantastic tool (CloneVDI 3.01). Nevertheless I would still like to react to your last 2 responses on my topic question.

I'm confused. Your description above says that CloneVDI gave error messages and you were therefore unable to clone and repair the VDI using CloneVDI.

However, the image you have provided is a CloneVDI created VDI image. Please explain.

On 12/10/2016 I asked for your help for the first time through this forum because I was unable to transfer the content from a relatively small fixed vdi to a larger dynamic vdi. Thanks to your tool (CloneVDI 2.51), this was achieved. Unfortunately, this cloned VDI was corrupted again a few weeks ago. Hopefully this will clarify the quote above.

Also, please tell me the exact size of this VDI file, in bytes.

The exact size of the corrupted VDI is 172 461 391 872 bytes.

The first entry in the block map is very strange. Have you previously resized this drive using VBoxManage? (not CloneVDI, the strange layout I'm seeing can only have been caused by an in place resize, and CloneVDI never does anything in place).

The storage capacity of the hard drive in the virtual machine was increased from 100 Gb to 300 Gb on 26/10/2016. I tried both (VBoxMange and CloneVDI), but I can no longer tell you which of the two failed at that time. It is therefore quite possible that this strange layout was caused by VBoxManage.

I've released a new version of CloneVDI to help with this fix, so please download it again and try it.

Your newest version of CloneVDI succeeded in repairing the corrupted VDI. Although the virtual machine is no longer bootable (Windows startup recovery reports irreparable damage in the boot sectors), I still managed to copy the data inside it to an external hard drive by mounting the .vdi on another pc using PowerISO.

Thank you very much for helping me out a second time. Your help is very much appreciated.

Kind regards.

Tim Van Deun

[mpack]

When I said that "the first block in the blockmap is very strange", I should perhaps have mentioned that the first block on the drive typically contains the boot sectors, so perhaps the "strangeness" was further corruption rather than evidence of in-place disk enlargment. That would explain why the drive still wouldn't boot after being repaired.

Anyway, I'm glad that the repair worked well enough for you to mount the drive and get the data off. I'll mark the topic as solved.