virtualbox.org

Hello!

I'm sorry if this is in the wrong place but I'm desperate. I've used Windows 7 and its XP Mode to run an old accounting software. When I upgraded to Windows 10 I backed everything up to run it using Virtualbox instead. Or so I thought.

What I did was back up the VHD located in C:\Program Files\Windows XP Mode\ which was around 6GB. I did NOT, however, backup the VHD located in appdata.

Am I screwed? I can't mount the VHD that I backed up in either Windows or import it in Virtualbox (or VMware for that matter). Does the one I have include any of the data of the virtual PC?

I'm extremely desperate because the person handling the accounting haven't made a backup of it for like three years (which I had no idea of since it's her job to do), which means I might just have lost 3 years that I need to have.

Again, sorry if this is posted in the wrong place but I have no idea where to turn.

Thank you all in advance!

"Win7 XP mode" defaults to creating what in VirtualBox are known as linked clones: i.e. the clone's hard disk is actually a difference image (similar to a patch list) which needs access to a read only base VHD to apply the changes to. The base VHD contains the basic, generic, newly installed XP image. Only changes are written to the clone hard disk - the base VHD is not copied. Nothing at all is written to the base VHD.

It sounds like you have a backup copy of the latter. So, I'm afraid that none of your data remains - all of that was in the differential image in the clone folder. If you have no backups at all of the clone folder then your data is gone.

The base XP image itself is also worthless. (a) it will not activate on anything except a Win7 Pro host, and (b) it contains nothing that you can't get from a fresh install from any old XP install CD - and the latter would not have XP Mode's host limitatations.

Just a tip for the future: it is almost never the correct thing to back up files in the "Program Files" folder prior to a major system event. Everything in the "Program Files" folder is... programs that originally got installed from an install CD/DVD and thereafter never changed. On a new host you would just install it again, from the same install CD/DVD. All of your data is in one of your data folders.

Yeah, I can see now that I'm pretty much screwed. I've been trying all kinds of programs to recover the other VHD file (no luck) and I even tried any VHD recovery programs I could find, hoping I'd find *something* on the un-mountable VHD I had.

One of them (and only ONE of them) actually found something. What it found was from another company that I don't have anymore, but it was newer than what I previously had from the backups. Not that it mattered in my case though, but still.

It searched through the VHD I had (from C:\Program Files\Windows XP Mode\) and found a partition and a whole other stuff. Not sure why no other program could find or search through the VHD but this one could.

Again, it didn't help me at all since it could only recover the other companies that are no longer in use and those files were from 2014 and had nothing to do with the current ones that I need. But at least the others were from 2014 instead of 2012. You know, in case the government wants to see the records - I don't have to re-do those again.

This was all done using the 6GB VHD file that I backed up from C:\Program Files\Windows XP Mode\ and it could actually be read and recovered. It couldn't recover everything, and I have no idea how it could recover anything, but it did. I won't link it here in case it's against the rules but what I used was a program called "Kernel for VHD".

In other words, it seems like there are some things that can be recovered from that - whatever it is - VHD. No idea how much though. :/

Anyway, I've come to realize that I am screwed and that I'll have to re-do all the accounting for the last three years. I mean, it's possible, it's just a whole lot of work that I'd rather not do.

Thanks anyway! Oh, and as a heads up - if I would ever need to backup my VirtualBox, are there several different places I need to back up?

Thanks!

Edit: And yeah, I know that *my* data is usually in appdata. But for some reason I never thought about that when it came to the virtual image. I backed everything else up (including lots of stuff in appdata) but, for some reason, thought that the Windows XP image - being 6GB and all - contained all the data from my virtual machine (which was way less than 6GB, but still).

In VirtualBox every VM lives in its own folder, which makes it easy to back up. You should avoid using linked clones or snapshots. The user manual provides details of where VBox stores your files.

As to finding data in the base VHD, it's a full image of XP system drive, so it should contain everything any new XP generic install would contain - i.e. nothing of yours. Don't waste your time trying to convince yourself otherwise.

Well, it end contain files that didn't belong in a new installation, namely the manually put directory "spcs" and some of its content, although not the ones I was looking for.

It's late here but I'll gladly offer a screenshot of the file structure and its content tomorrow.

Alright, good morning to you all!

Now, I know pretty much nothing about this stuff, I only used the XP Mode to run a single program. I'm well aware of that you're very experienced in this topic and I'm not saying you're wrong, I'm just trying to explain what I'm seeing.

Since I can't paste links yet, I'll leave these two incomplete links, they're hosted on imgur.com/pr4FqEC and imgur.com/61BufBo.

Sorry for the inconvenience!

I'm not entirely sure what you want me to notice. True, I admit that I'm not familiar with the contents of SPCSADM: if not original to XP mode then it implies that at some time the base VHD may have been incorrectly mounted in a VM while that software was installed - not a huge surprise when the user is inexperienced. However everything else looks stock, so the mistake seems to have been short lived. In any case that is the Program Files folder, and therefore still can't contain any of your data.

Yes, everything else looks stock since nothing else has been touched. The XP Mode was only used to run that specific application and nothing else. Not sure what you meant by the Program Files folder can't contain any of my data - it's there, you can also see it and I successfully extracted that content from the VHD yesterday. SPCSADM saves company records and files in its own folder in Program Files; every company gets a new folder called FTGx (where x is the number of the company) so what I could get from the VHD was company 3, 4 and 5.

I have no idea how it happened, since what you're telling me is correct and it shouldn't be possible to find any other files than stock Windows. But somehow I did. If it was incorrectly mounted in a VM at some point - well, then the XP Mode did that by itself since it hasn't been touched or used for anything else than using SPCSADM.

I'm sorry, it sounds like I'm trying to argue with you - that isn't the case, I'm well aware that you're the experienced one and I don't know much about this at all.

I guess my point is that it CAN be possible to get some information back even if you've lost the clone disk. How it happened, I have no idea, but it did and the files worked (although they are not the companies that I need but still better than not having them at all). Just in case someone else does the same mistake as I did.

Anyway, if nothing else, I've learned my lesson and will make sure to do the backup of accounting myself. I've installed Windows XP using VirtualBox now and it works great! Thank you and take care!

Did someone else set up the original VM for you? If they knew what they were doing then it would have been possible to launch the base VM and then install all the standard applications that a user requires. Being in the base VM would ensure that all normal VMs created in future - which are actually linked clones - would have that application preinstalled. The IT guy who did this for you no doubt created your first user level VM too.

But again, it would not have any of your data. Are you sure that any data you see is not part of some demo/sample project that comes with the software? That data would be installed with the software in Program Files.

No, I was the one who did it. I simply downloaded the XP Mode from Microsoft's website, followed the instructions and it was done. After that, I manually pasted SPCSADM into the Program Files from the previous backup that I had. That's it. After that, the accountant only used the shortcut on the desktop (from Windows 7) to launch SPCSADM as if it was any other application. She never noticed the rest of Windows XP while running SPCSADM.

The folders FTG3, FTG4 and FTG5 was included in my old backup that I pasted into the directory - but so was FTG1 and FTG2 but they're not there now. However, this was done several years ago and the last modification of the three companies that I could extract was made about a year ago, so it was modified long after the installation of XP Mode. They are not sample or demo projects, they are real companies.

SPCSADM (SPCS Administration) is a 16-bit program which is about 20 years old. If I were to use the floppy disks to install it (which I can't since I don't have a floppy drive anymore), it would default to C:\SPCSADM. I simply didn't want it there and since it still only create folders and files within its own folder where it is installed, I put it on Program Files to make it look better than clutter the root of C:.

And when you "pasted" this folder into the original VM, is it possible you used a similar VHD viewer tool to the one you are using now? Obviously that bypasses the normal operation of the VM. If done right away then it's possible this would not have corrupted the clone VM (no data in clone to be corrupted).

No, I did it from within Windows XP using XP Mode.

Well, something here doesn't wash. You were clearly using the linked clone mode, otherwise you would still have your data - and in any case it would never end up in "Program Files". It is a fundamental requirement of difference schemes / patch lists that the root element must be locked (read only), because any change will invalidate the change list, so in general a user who has this problem can never expect to find his data in the root element.

Well, yes, something isn't quite right. But of course the information would be saved in Program Files - SPCSADM doesn't save anything in a different place than its own directory. At all. No matter where it is, it will always save files and create folders in SPCSADM, not create something some place else.

Edit: Oh well, I'm obviously not getting any other files back and I've learned from my mistakes. It's just weird that I got something back when I clearly shouldn't.

I'm not sure what you are saying: difference schemes work at a sector level, not a file/folder level.