Deleted Virtual file! Help!

[Michael-DXC]

Sorry if this is posted somewhere but this got dropped into my lap.

User/Update delete the main file for his virtual desktop. No recovery, no backups. What he does have is 2 snapshots listed in the dashboard. I see two files for the snapshots, one is 24 gig the other is 31 gig.

The version is 5.2.12r122591 Qt5.6.2

Is there something I can do with this? rename the snapshot and start it? Any attempt to clone/start gives me a missing drive file message. I have attached screen shots of what the user has

Any help, links or FAQ link would be great.

Thanks ahead of time!

[mpack]

The deleted main file being the ".vbox" file? Is there a "xxxx.vbox_prev" file in the "VirtualBox VMs\Work" folder? If there is then you can just rename it (give it the ".vbox" extension) and the VM will probably work.

If you don't have the ".vbox" or the ".vbox-prev" then the VM cannot be fully restored: it should be possible to recover the contents of the disk drives, but the VM will act like a PC which has had the motherboard replaced, i.e. any software which requires activation (including the guest OS if Windows) will need to be reactivated.

So, with that understood, here is the procedure for getting the data back. Please follow the instructions VERY carefully since I have little patience for people who don't and then mess up.

1. Move all 4 snapshot VDIs, plus the base vdi "work.vdi" into one host folder.
2. Identify the newest snapshot, i.e. the one with the newest creation timestamp, then run CloneVDI and clone that snapshot VDI. Use "Keep UUID", you can enable compaction if you want (it may make the process go faster and use less disk space).
3. Using VirtualBox, start the process of creating a new VM <Yourname>. When you get to the disk creation step select "Use existing", when the VDI selection dialog appears you should ignore it for the moment, instead switch to a host file explorer window, find the clone VDI, rename it to "Yourname.vdi", and move the VDI into the new VM folder.
4. Now you can switch back to the VDI selection dialog and select the VDI from where you just put it.
5. Naturally you should try to make the new VM settings as much as possible identical to what they were before.

[mpack]

Actually, come to think of it: where does that screenshot of a snapshots tab come from? That information comes from a VM control file, you couldn't possibly get to that screen without one. I do believe we are missing an important part of this story.

But, the snapshots shown in the screenshot are from 2017. In the actual folder I see two snapshots from 2018 (one has 30GB of data), so the screenshot doesn't match whats in the folder.

No matter, the recovery procedure I mentioned should still work, provided that "work.vdi" file is the correct one (I note that it is not in the VM folder where it should be).

[Michael-DXC]

here's the break down.
Client has the virtual in a different folder that was supposed to be backed up. Didn't verify that it had been backed up an deleted the virtual file.
The snapshots are located in a different folder where they are supposed to be.
I d/l some utils to try and recovered the deleted file but came up empty.

I D/L the ZIP for the tool and ran per your instructions and I am getting this error message. Any ideas?

thanks

[mpack]

That error message means that CloneVDI could not find a complete snapshot chain in the current folder. So either you didn't pay attention to step 1 of the procedure I gave above, or you don't have all the pieces of the chain.

If you use the "Show Header" feature in CloneVDI then you can view the UUID of the current VDI, along with the parent UUID, i.e. the expected UUID of the previous VDI in the chain. If the parent UUID is zero then you have reached the first element of the chain. You should be able to verify manually that an entire chain is present.

Just to be clear: it is impractical to recover any data (impossible with an automated tool) unless an entire chain is present. That is why most experienced users avoid snapshots.

Btw: attempting to "undelete" a VDI file would be a waste of time. The file is far too large. IME any vendor claiming otherwise is selling snake oil. Undeleting a .vbox file may be practical, as it's usually just a few KB, and it would be very easy to view the resulting file in a text editor to verify that it's clean.

[jmorcillo]

Hi mpack, this procedure, I can use for .vmdk files too?
Regards

[mpack]

If it's a snapshot chain that originated in VirtualBox then yes, it should work. But, there are no promises if you choose to use a non native disk format in VirtualBox.