Snapshots unseen and cannot delete

[chapeaurouge]

Screenshot, to confirm what I've been saying like 5 times.

It all works, I don't get any errors... just not a single file after a clone operation. I will have to repeat the clone operation at home to give you the output.

[chapeaurouge]

Tip for the future: when you want to insert the Guest Additions CD, click the "Devices" menu of the VM and select "Insert Guest Additions CD image...". There is no need to go hunting for it, since the correct ISO is bundled with the VirtualBox download. You seem to have been collecting GAs ISOs from weird versions and places and mounting them in the VM.

That's what I usually do, unless I am behind a firewall that breaks the certificate chain (i.e. corp environment that decrypt all your ssl flux).

[chapeaurouge]

And just in case

Code: Select all

$ VBoxManage snapshot corpvm1 list
This machine does not have any snapshots

[socratis]

OF COURSE IT DOESN'T!!! IT NEVER DID!!!
You have a VM, VMcorp2. This looks like that:

• {d7b56b52...}           <-- That's the base vdi of VMcorp2
    |
    +--- {9b85065f...}    <-- That's the snapshot of VMcorp2

You created a second VM (corpvm1) and you mistakenly pointed it to an existing disk: A SNAPSHOT!!!

• {9b85065f...}           <-- That's the base vdi of corpvm1

See? No snapshot for your "corpvm1".

[chapeaurouge]

I guess it did before I messed it up, right? (I remember seeing it)

You make total sense. So, is there a way to make this up or not?

Thanks.

[socratis]

Potentially, it depends how bad you've messed up with. But before that, I need to ask a couple of questions.

I see that the "corpvm1" is in a Saved State. You claim that if you Resume that VM, shut it down and restart it, that thing works???

And secondly, although I don't see it in the picture, I assume that you still have the "VMcorp2" in your VirtualBox Manager right? (please say yes)

[chapeaurouge]

Everything works just peachy. I am using it just now, as we write. And it did start exactly where I had left it off before all this happened. I can start, suspend/resume as normal.
So it is not messed up to me

VMCorp2 is gone. To me, that's just how I name my VM right. I hope VB does not rely on labels, and more on its uuids? VMCorp2's disks are the ones I am using now for corpvm1. AFAIC, they are the same machine.

[chapeaurouge]

File listing:

Code: Select all

$ ~/vms/virtualbox/FBI-corp-vm  ls -R
.:
Logs  Snapshots  vbox_file.zip  VM14416.vdi  VMcorp2.vbox  VMcorp2.vbox-prev

./Logs:
VBoxHardening.log  VBox.log  VBox.log.1  VBox.log.2  VBox.log.3

./Snapshots:
2017-06-27T07-51-42-676449000Z.sav  2017-08-17T15-38-59-923268000Z.sav  {9b85065f-248d-4530-832e-17cc73b4da5d}.vdi

[chapeaurouge]

So what you mean is that the file "VM14416.vdi" is no longer used at all?

Maybe a detailed listing helps with file sizes:

Code: Select all

~/vms/virtualbox/FBI-corp-vm  ls -ltrR
.:
total 52279340
drwx------ 1 fblaise users         220 Aug 17 17:38 Snapshots
drwxrwxrwx 1 fblaise users         110 Aug 17 17:48 Logs
-rw------- 1 fblaise users       17455 Aug 17 17:52 VMcorp2.vbox-prev
-rw------- 1 fblaise users       16570 Aug 17 17:53 VMcorp2.vbox
-rwxrwxrwx 1 fblaise users 53533999104 Sep 10 23:10 VM14416.vdi
-rw-r--r-- 1 fblaise users        3117 Sep 12 11:01 vbox_file.zip

./Snapshots:
total 52871696
-rw------- 1 fblaise users  1517835366 Jun 27 09:52 2017-06-27T07-51-42-676449000Z.sav
-rw------- 1 fblaise users   939515904 Aug 17 17:40 2017-08-17T15-38-59-923268000Z.sav
-rw------- 1 fblaise users 51683262464 Sep 12 13:08 {9b85065f-248d-4530-832e-17cc73b4da5d}.vdi

./Logs:
total 2636
-rwxrwxrwx 1 fblaise users  387831 Apr  7 07:07 VBoxHardening.log
-rw------- 1 fblaise users    3216 Aug  7 21:26 VBox.log.3
-rw------- 1 fblaise users    3216 Aug  7 21:32 VBox.log.2
-rw------- 1 fblaise users 2061422 Aug 17 17:39 VBox.log.1
-rw------- 1 fblaise users  236810 Aug 17 17:52 VBox.log

[socratis]

No, "VM14416.vdi" is your hard drive. DO NOT TOUCH ANYTHING!!!

When you're ready to solve this thing, shut down the VM. Completely. Then send me the .vbox file and an updated "ls -alR" of the "/vms/virtualbox/FBI-corp-vm" dir. In the mean time you do NOT touch VirtualBox *or* your file structure with a pole. OK?

When we're done, you're going to have to do some cleanup in your VirtualBox, following the exact steps that I'm going to give you. You'll end up with a proper structure, with proper naming. You know... normal.

[chapeaurouge]

OK, will do. (still odd though that my real harddrive file hasn't been modified for the last couple days?)

There, so it is now stopped. Listing is:

Code: Select all

$ ~/vms/virtualbox/FBI-corp-vm  ls -ltrR
.:
total 52279340
drwx------ 1 fblaise users         220 Aug 17 17:38 Snapshots
drwxrwxrwx 1 fblaise users         110 Aug 17 17:48 Logs
-rw------- 1 fblaise users       17455 Aug 17 17:52 VMcorp2.vbox-prev
-rw------- 1 fblaise users       16570 Aug 17 17:53 VMcorp2.vbox
-rwxrwxrwx 1 fblaise users 53533999104 Sep 10 23:10 VM14416.vdi
-rw-r--r-- 1 fblaise users        3117 Sep 12 11:01 vbox_file.zip

./Snapshots:
total 52871696
-rw------- 1 fblaise users  1517835366 Jun 27 09:52 2017-06-27T07-51-42-676449000Z.sav
-rw------- 1 fblaise users   939515904 Aug 17 17:40 2017-08-17T15-38-59-923268000Z.sav
-rw------- 1 fblaise users 51683262464 Sep 12 17:29 {9b85065f-248d-4530-832e-17cc73b4da5d}.vdi

./Logs:
total 2636
-rwxrwxrwx 1 fblaise users  387831 Apr  7 07:07 VBoxHardening.log
-rw------- 1 fblaise users    3216 Aug  7 21:26 VBox.log.3
-rw------- 1 fblaise users    3216 Aug  7 21:32 VBox.log.2
-rw------- 1 fblaise users 2061422 Aug 17 17:39 VBox.log.1
-rw------- 1 fblaise users  236810 Aug 17 17:52 VBox.log

[socratis]

Something is not right. "VMcorp2" is NOT gone.

The file you sent me is called "VMcorp2.vbox". The VM is called "VMcorp2". And the UUID does *not* match the one from "corpvm1". Open it with a text editor and look for yourself:

<Machine uuid="{8d162bd8-b8a7-4a0f-83f3-a0066bf6d359}" name="VMcorp2" OSType="Windows7_64" currentSnapshot="{ecb48390-f1ab-47b2-8c59-99cc4964fff8}" snapshotFolder="Snapshots" lastStateChange="2017-08-17T15:52:57Z">

Open VirtualBox, right-click on the "corpvm1" and select "Show in Finder/Explorer/Whatever". Where is that "corpvm1.vbox" file located? Send me that one as well.

[mpack]

Something is not right. "VMcorp2" is NOT gone.

Mounting the difference state by itself is nonsensical. It shouldn't have worked at all, I assume it only did because this or some other VM still has the base VDI registered.

We go around in circles.

Even from a saved state, there is no way that a VM starts up without a complete snapshot chain. Both disks must be present (registered), not necessarily by the same VM. The disks need only be registered, they don't have to be mounted.

[socratis]

@mpack
Say you have VM "A" with a snapshot. Say you create a second VM "B" and you point it to the snapshot as its main HD. Say you remove A without removing its files. Are you saying that B will continue running as if nothing happened?

[chapeaurouge]

@mpack, @socratis, you're right, my bad. The hdd files being there, I didn't pay attention and sent the older vbox file. After re-creating the VM, that new one went to the "regular" folder and the actual vbox is indeed in that folder. Sorry about that, did not mean to add to the confusion.

I am attaching the correct vbox here.

And the listing in there, showing there is no hdd files in that folder:

Code: Select all

~/VirtualBox VMs/corpvm1  ls -ltrR
.:
total 20
drwx------ 1 fblaise users   76 Sep 12 17:09 Logs
drwx------ 1 fblaise users    0 Sep 12 17:10 Snapshots
-rw------- 1 fblaise users 8027 Sep 12 17:29 corpvm1.vbox-prev
-rw------- 1 fblaise users 8025 Sep 12 17:29 corpvm1.vbox
-rw-r--r-- 1 fblaise users 2235 Sep 13 08:21 vbox_file_corpvm1.zip

./Logs:
total 804
-rw------- 1 fblaise users 244221 Sep 11 15:07 VBox.log.3
-rw------- 1 fblaise users 196100 Sep 12 10:15 VBox.log.2
-rw------- 1 fblaise users 169950 Sep 12 13:10 VBox.log.1
-rw------- 1 fblaise users 205689 Sep 12 17:29 VBox.log

./Snapshots:
total 0

Thanks again for the help.