Page 1 of 1

Recover lost files from previous current state

Posted: 23. Sep 2020, 19:08
by mjrarcher
Hello all,

I accidentally restored my VM to a previous snapshot and have therefore lost all my files.
I have searched desperately for a solution, but can't seem to find one.
I would really appreciate any help.

Re: Recover lost files from previous current state

Posted: 23. Sep 2020, 19:47
by scottgus1
I am not too solid on snapshot use, but I think you're in trouble.

I took a throw-away DOS guest, made Snapshot 1, started the guest, added a file to the guest & shut down, made Snapshot 2, and started the guest, added a second file to the guest & shut down.

So my snapshot chain was: Snapshot 1 > Snapshot 2 > Current State

Then I instructed Virtualbox to restore Snapshot 1. A pop-up warned that the Current State of Snapshot 2 would be lost unless I made another snapshot. I ignored the warning and restored Snapshot 1 without making the new snapshot of the current state.

The second file I added was lost. Restoring Snapshot 2 did not restore the file, because Snapshot 2 was of the state before I added the second file. I monitored the creation of disk files in the guest's Snapshots folder, and the snapshot disk file that contained the Current State did disappear.

You can use Mpack's CloneVDI to make clone disks of the most recent snapshot disks in the guest's Snapshots folder, then attach the clones to another guest, to see if the missing files might be there. But I did the same thing and could not recover the second missing file.

You must prepare yourself for loss, unless you ran backups of the guest.

Re: Recover lost files from previous current state

Posted: 24. Sep 2020, 10:04
by mpack
scottgus1 wrote: You can use Mpack's CloneVDI to make clone disks of the most recent snapshot disks in the guest's Snapshots folder
If VirtualBox "restored" to an earlier point in the timeline then snapshots from later times were deleted. So the current state is the most recent.

The only thing that would save "mjrarcher" is a backup from before the data was deleted.