virtualbox.org

Hello!

I know that there are already many posts with a similar problem, and I read some of them but they didn't really help me.
Also please excuse my bad english, it is not my first language.

Two days ago I tried to resize a partition using EaseUS Partition Master (I had 2 partitions, one (partition C) with windows 10, and a second one (partition D) containing installed software and a few virtual machines (in .vdi format), and a third one with Linux as a second OS on that laptop) (I had to use EaseUS because Windows itself just couldn't increase the size of the partition). So I started the process, the pc restarted, but after the restart partition D (the one that I tried to increase in size) was not accessible with the explorer (it was listed as RAW under Windows Disk Management).

Using a program called TestDisk I scanned partition D to recover the files. TestDisk was able to show the partition just as it appeared before EaseUS messed it up (all the folders and files were there). I then managed to copy everything important (including all vdis), and everything was in working condition (all the files could be opened, except the vdis which i couldn't try).

I then saved my files to an external hard drive and tried to rewrite partition D using TestDisk, but it got even worse, because after starting the progress the computer rebooted and the pc only showed "Your PC/Device needs to be repaired. File: \WINDOWS\system32\winload.efi Error code: 0xc0000225".

I created a Knoppix Live USB stick on a different pc, started it and was able to access both Windows partitions. I then just copied everything (both partitions, completely) to an external hard drive (also copying all the data i already copied with TestDisk, again). On the second pc I then installed VirtualBox and tried to open the vdis, but 2 of them didn't work anymore, one of these two containing really important data.

When I create a virtual machine and try to use the .vdi file containing that data it just says "Could not get the storage format of the medium" (see attached file). I then tried to duplicate the vdi using CloneVDI (because I read that this error could occur when using a different version of VirtualBox than the one that was used creating that vdi) but also had no luck (see attached file). Then I tried to open the file with Frhed (see attached files).

I then searched for possibilities to scan the vdi to somehow extract at least some files, but couldn't find any solution. Then I had the idea to create an empty partition, I copied the vdi file to it and scanned the partition with data recovery tools, among EaseUS Data Recovery. It was actually able to scan it, showing me some of the files that were on that vdi so I guess it's not completely corrupt and unusable (see the attached file, this is one of the pictures EaseUS was able to read from the vdi file). This just leads me to believe that it actually can be repaired somehow and made bootable again or at least can be scanned and the files can be extracted (whats weird though is that EaseUS finds 235 GB of files, but this second pc I'm using right now only has approx 55 GB and the vdi file I'm trying to repair/I scanned only has approx 20 GB so I don't really understand whats going on there and where it finds all those files, but at least it shows some data that was part of that vdi (and no, there is no external medium attached)).

My questions are now:
1.) Is there (after somehow turning partition D from ntfs into raw and making windows unbootable) even a way to simply restore everything as it was two days ago (make it bootable again (editing winload.efi) and just being able to access partition D like before) or do i just have to reinstall windows?
2.) Is there a way to either repair that vdi or to completely scan/extract all usable data from it (because EaseUS didn't find everything I need)?

Sorry for writing that much but I thought i might just write everything that happened.
Thanks for reading and thanks in advance to everyone trying to help.

Think of a file as a big cardboard box filled with bytes. The filename is a label written on the outside of the box.

If you damage your box then box recovery tools exist. For a moderate fee you'll have a tool that recreates the exact size and shape (exact volume) of your old box, and puts a very similar name label on the outside. All very easy so far. But does it have the same bytes inside? Now that is the important question.

Newbies have an adorable faith in the power of such tools. They believe that just because the box is labelled correctly, the contents must be correct. It must be nice going through life with such faith in the honor of snake oil salesmen.

The reality is that file recovery is only easy: (a) if the deleted file is relatively small, (b) if the filesystem is largely intact, (c) there has been no significant manipulation of the filesystem since the damage occurred. None of that was true in your case. Your chances of recovering any large file was essentially zero, and if a snake oil salesman told you differently then you were scammed.

The VDI you have is not a VDI file. It's just a box containing garbage with "VDI file" written on the outside. CloneVDI told you as much when it told you that the contents were not recognizable.

In future I recommend that you make backup copies of important files before trying something this potentiantially catastrophic. Because, forget snake oil salesmen, a backup is the only cure for what ails you.

Thanks for your reply.

So the vdi file was damaged while trying to increase the partition size. So basically I'll not be able to make it bootable again I guess (and what does the output of Frhed tell you, that it was damaged beyond repair?).

I just don't really get why the file was damaged so badly, because after the partition was listed as raw, I didn't install anything on that hard drive anymore.

Oh, and the EaseUS scan is the result of recovering the file from partition D with Knoppix, and scanning just the vdi file... but as you can see, the scan does find a few of the files that were on that vdi, so that is the only chance to recover files from it I guess.

I didn't actually notice that you had provided frhed screenshots but yes, it shows that the VDI contents are not from a VDI.

yr282 wrote:but as you can see, the scan does find a few of the files that were on that vdi, so that is the only chance to recover files from it I guess.

If you review the parameters I told you about which weight your chances of successful file recovery, you'll see that you can probably only do it with small files. JPEGs for example are designed to be small. I'll be surprised if you recover anything very large, but certainly there's no harm in trying: and do make sure that it has recovered the box contents, not just the box label and size.

Thank you for your answer.

For some reason my reply got removed. It basically said:

Using a bootable Windows 10 USB device and this video (https://www.youtube.com/watch?v=g6s9JA_jq8k) I was able to boot Windows 10 again. I can now access partition C as before and partition D all of a sudden aswell (it basically looks exactly as it looked like before all that happened). I just tested all programms, games and files located on partition D and they all appear to work, only these two vdi files refuse to load (which is, I guess, because they are simply way bigger than all the other files, and therefore the change of damaging them was higher), a third vdi file appears to work aswell.

Basically from those two vdi files only one contains important data. I only had Windows 7 installed on it, IBM Lotus Symphony, and Guest Additions. And I only had the following files on it: jpeg images (about 200 I guess, each one approx 2000 KB), quite a few txt files (about 100, approx) and a few Symphony-Spreadsheets (.ods), from which one is actually the only important file on that whole vdi (so not anything large, except the jpeg files, but the ods files maybe had 1 or 2 MB, I can't tell, they were only filled with text). I would say there were maybe 400 MB of jpegs and maybe about 3-5 MB of txt and ods files (and those 3-5 MB are actually way more important to recover than the jpeg files), so not much at all.

Right now I'm still scanning those vdis with various recovery tools in hope to get any data out of them. But I have no idea how vdis are built/work and how file storage works in general. The preheader/header of the vdi may be corrupt, and also some files within (because windows does not boot anymore), but maybe the MFT/MFT backup is still intact (which is, as I read, basically the most important thing, because without it no files can be accessed anymore, but the fact, that I was able to recover a lot of files already is a good sign I guess). Is there any way to show the original filetree? All the files were stored on the desktop, there was one folder, another folder with many subfolders and a txt file. It would just be way easier to know the names of the original folders.

I also managed to recreate the header of the vdi file (with the help of this thread: viewtopic.php?f=7&t=74009), so now virtualbox at least accepts it, but of course it can't boot anymore (I have no idea if this header was only designed for that vdi or if every header basically looks the same/is similar).

I might also try what "Takkat" suggested here (http://askubuntu.com/questions/425518/r ... achine-vdi), do you think that might help in this case (turning it into RAW etc.)?

Today morning I was able to successfully recover every personal file that was located on the vdi. I'll just write down how I finally achieved that (might help others who have a similar problem, who knows): First of, I copied the original (obviously damaged) vdi file from the partition that turned into RAW using a Knoppix Live USB drive (because on my first tries to recover the vdi I even managed to make Windows 10 not being able to boot, therefore I had to use a live system). I copied the file on a different laptop and there I created an empty partition where I just placed that single file. Then I used R-Studio Network 7.8 to scan the partition where the vdi was located on. R-Studio was able to recover approx 20 "partitions" within that single partition (I guess all these old partitions where from previously installed Windows copies, because I bought that laptop used), the "virtual" partition from the vdi was among them. So after R-Studio was able to recover the right partition I scanned it to list all files. It then created the correct filetree and listed all my personal files (correct filenames, correct details, etc.) and I simply copied them to another external hard drive.

Took me about six days (because I tried various methods and tools to recover the data, and the fact that I know basically nothing about file recovery didn't really help) but I finally made it.

Thanks again for your help, thread might be closed.

Well done for your perseverence. In fact what you did was impossible to my knowledge - dynamic VDIs don't have a contiguous block order, so dumping their contents onto a hard disk and scanning the contents shouldn't have led to a full recovery of the files (only the filesystem, because that was all created at once). But, if you are happy then I am.