ubuntu - How to recover previous "current state" from VirtualBox *after* restoring from snapshot

07
2014-07
  • JesseM

    Details:

    Win 8.1 (host OS) Laptop running Virtual Box. Ubuntu 10.04 Guest machine inside Virtual box. 6 month old snapshot of guest machine and "current state" in use. User was having problems with "current state" machine loading slowly (maybe hanging) and at one point VirtualBox helpfully asked if they'd rather restore snapshot. Not realizing that this would dump their "current state" machine image, they said yes, and have now lost 6 months of data.

    (Yes, I know, they should have backups. Not helpful at this juncture. Currently I'm looking for recovery options for them)

    Is there any way to recover/restore the previous "current state" VM from before they agreed to go to the snapshot?

    I've got the machine shut down now, so some sort of data recovery may be possible if it's "just" a deleted file I can get back from the host Windows OS.

    Any help appreciated, or recommendations for specific file/data recovery tools, or which vmd/vdi file to look for.

    Thanks.

    Edit 1: Working on the theory that the "current state" was just an other .vdi file, and that I might find it with generic Windows recovery software, I started looking for possible candidates. A "quick" scan found (and recovered) the "vbox-prev" file, but didn't find the .vdi file. However, the "prev" file gave me the filename of the missing .vdi file, so that's some progress. I'm now trying a deep scan.

    The scan tool I'm using lets me define new file formats to look for in bytes on the disk, but it needs "magic bytes" and an offset and data length. It seems a fine tool, but these advanced search features are not well documented. If anyone has a pointer to the .vdi file format, that would be great.

    For those who may find this later, current .vdi files all begin with (little endian) bytes that look like this:

    0000000 < < < O r a c l e V M V i 0000020 r t u a l B o x D i s k I m 0000040 a g e > > > \n \0 \0 \0 \0 \0 \0 \0 \0

    or

    0000000 3c3c 203c 724f 6361 656c 5620 204d 6956 0000020 7472 6175 426c 786f 4420 7369 206b 6d49 0000040 6761 2065 3e3e 0a3e 0000 0000 0000 0000

    • Answers
    Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

    Related Question

    recovery - How to get data from a VirtualBox .vdi file?
  • Cipher

    I have wrongly removed the parent snapshot of a virtual machine so that I cannot recover the latest environment. VirtualBox shows me info similar to below:

    Parent hard disk with UUID {943bb73f-15cb-4ac1-d8b9-5869e60a69bc} of the hard disk '/media/win/TestS/Snapshots/{bf88b943-d27f-42b3-e28e-d5ebe6ffc523}.vdi' is not found in the media registry ('/home/air/.VirtualBox/VirtualBox.xml')

    Could I recover my virtual machine? Or open the .vdi file to get my data?


    • Related Answers
  • JRobert

    It sounds like you've unregistered the .vdi file within VBox but that you still have the file - correct? And you want data from that parent disk? Try making a new VM and attaching the file as an existing hard disk. If that fails, clone the.vdi with

    vboxmanage clonehd <the-old-vdi-file>.vdi <a-new-name>.vdi

    You should be able to attach that.

  • oldefoxx

    Each VDI (virtual drive image) has its own unique UUID. If you merely try to copy the VDI file, you get an exact match (clone) including a duplicate UUID. VirtualBox modifies the clone process so that a different UUID is assigned. That way you can have a duplicate VDI that can be mounted as a guest separately, or accessed from a different client if you set it up under shared folders. If you can't mount the original, you can discard the guest entry for it -- but don't delete the VDI itself. Just set up a new guest, and reuse to original VDI for it. You just use an existing hard disk instead of creating a new hard disk