virtualbox.org

Hello,

As descriebed in the title I made a mistake, I haven't "saved my VM" (also Debian 10 guest) before restoring another Snapshot.
The problem is that we are talking about 6 month of personnal work on this not saved VM.
I would appreciate a lot if anybody could tell me any risky procedure to try to recover the previous state.
What interests me in this VM is a hundred files of .cpp and .h textplain.
Do you have any tool to give me for Debian 10 to recover such files on the hard drive (even if I still know exact string of text written in the one hundred files).

Hope you'll save my VM (and my life by the way)

If you need any information, tell me so.

PS: can we look into .vhd file for textplain stored within the guest OS ?
Hopefully we are talking about unencrypted VM of course.

Thank you in advance

Files inside a non-encrypted vdi are kept in clear-text, to the best of my knowledge, and should be readable from the outside.

Snapshots are changed disk sectors, though, and may not contain the whole file.

You might try undelete programs to see if the full files might still be available, as I believe that the 'current state' difference disk disappears if you don't 'save' it when switching snapshots.

If by chance the 'current state' difference disk is still there, you can try Mpack's CloneVDI under Wine (see also viewtopic.php?f=7&t=22437) and follow CloneVDI's instructions to clone the snapshot files that are available to a different host disk, and try them in a new guest to see if the files appear.

I recorded when I made my mistake (see attachments list (YT)). I would like to restore the VM where I was having troubles with (initramfs) (in the background at 51:28). At this timecode we see that I restore a Snapshot and VB doesn't ask me whether or not to save.
When I restart I have a very old version of my VM. At 55:40 we see the snapshot folder. (here is the same screen but taken now (see attachments list (snapshots))). We can see that there is only a new file: {1e401282-ee92-4694-8482-69efed073a42}.vhd which by date is new. The main vhd: "Debian compilator.vhd" seems not to have changed a single bit because last modify/change date is a 2019 date.
So to put it in a nutshell, I got everything (plus a file) but I still have an old state of my VM. How to "remove the new file" correctly in "Debian compilator.vbox" (here you may find the current version of this file (see attachments list (vbox))) ?

Thank you again

Sorry for not using URLs (see attachments list) but I can't use such because I am a new member on this forum.
EDIT: If needed at 56:09 we see in VB the snapshot tab.

Closing the VM window and selecting Power off the machine is the equivalent of pulling the power plug on a physical computer without shutting down the OS. Additionally selecting the checkbox to Restore the current snapshot means throwing away anything that has been done after the latest snapshot. This is the typical workflow if you want to try out something in a VM and go back to where you started afterwards.

If you created Snapshot2 in January 2019 and have been working with the ever changing 'current state' since then, you deleted your work from the virtual hard disk yesterday, because the file containing the current state on the physical hard disk was emptied deleted and replaced by a new file with a new name then. The previous contents still existed in the free sectors of the SSD afterwards. Depending on how much you've been writing to the SSD since then, the data is still lying around somewhere ...

Edit:
Clarified that the old current state file has been replaced by a new one with a new name.

How can you be so sure that my data was erased at 51:37 on the Youtube video (see attachments list) ? There is absolutely no warning with bold text or red etc...

At 51:27 you powered off the VM with 'Restore current snapshot (Snapshot 2)' selected.

When 'Restore current snapshot' is selected, the disk file containing the changes since the snapshot was taken gets deleted, and a new disk file is made. You can watch this happen by repeating the process on a throwaway guest while the guest's Snapshots folder is open. The most recent disk file will delete and a new disk file appears.

The Virtualbox manual states under 'Restore a Snapshot': https://www.virtualbox.org/manual/ch01.html#snapshots

The current state of the machine is lost, and the machine is restored to the exact state it was in when the snapshot was taken.
Note: Restoring a snapshot ... all files that have been created since the snapshot and all other file
changes will be lost.
To avoid losing the current state when restoring a snapshot, you can create a new snapshot before the restore operation.

and under "Power Off the Machine': https://www.virtualbox.org/manual/ch01. ... hine-state

if your virtual machine has any snapshots, see chapter 1.10, Snapshots, page 16, you can use this option to quickly restore the current snapshot of the virtual machine. ... any changes made since that snapshot was taken will be lost.

When you clicked 'Restore current snapshot' it told Virtualbox to reset back to when you took the snapshot.

Benjamin Loison wrote:There is absolutely no warning with bold text or red

When I tried the 'Restore current snapshot' checkbox I too did not get a warning box, even after resetting all warnings. As best I see there isn't a warning box. The manual does say at least 4 times that restoring a snapshot will erase the current state unless another snapshot is taken.

Like all other powerful tools, snapshots must be understood to be used safely. The forums are replete with users destroying their important data because they did something wrong with a snapshot.

The only thing that has a fairly good guarantee of getting your files back is to restore them from your backups.

The contents of the previously-existing current state are probably still on the PC's disk.

scottgus1 wrote:try undelete programs to see if the full files might still be available

fth0 wrote:Depending on how much you've been writing to the SSD since then, the data is still lying around somewhere ...

Get an undelete program and run it on your host disk. Some of the files might be found.

I know of no method in Virtualbox to get the current state data back.

Benjamin Loison wrote:How can you be so sure that my data was erased at 51:37 on the Youtube video (see attachments list) ?

For once, I'm using this method deliberately nearly every day. And you don't just have to believe me, just read the VirtualBox User Manual, e.g. 1.8.6. Saving the State of the Machine.

Thank you for every answer. I am not keen on VirtualBox but I am keen on Linux so with a bunch of grep uses on /dev/sdXY I retrieve all my text files.

If there any kind of thread close, you can close this one.

Thank you again. I will pay more attention next time.

Your welcome, and thanks for reporting back.

Benjamin Loison wrote:If there any kind of thread close, you can close this one.

You can just prepend "[Solved] " to the title of your initial post if you like.