1

2 years ago I had that brilliant idea to create base Windows XP disk which all of my VM with XP will use.
Of course it ended that I had only one VM with XP :-).

Today I needed to make some free space on my HDD so I found one not used VM named "Windows XP" which had only 5GB. I deleted it as fast as possible :-) and of course I used shift to not use "Recycle bin".

Now when I want to run my XP VM I have following error: "One of the parent hard disks of ... is missing."

It's not a problem for me as soon as I can restore files from this differential vhd that I have right now.

So:

  • I have differential disk with files I need
  • I don't have parent disk

My question is: How can I restore files from this differential hvd?

1
  • Why didn't you backup the .vhd before deleting it?.. Does your host have system restore turned on?.. I never use .vud's, only dynamic disks so when I turn off the VM, it already has the changes written.
    – Joe R.
    Jul 6, 2011 at 17:48

4 Answers 4

2

If it's only 5Gb you might want to try a piece of Recovery Software like Diskeeper's Undelete.

Update: the piece of software I use and have found very useful is WinUndelete which will tell you if the file is recoverable. This may be the path of least resistance going forward. I will post further information about recovering from differencing disks shortly.

Update (2): Per Ben Armstrong (Microsoft's Virtualization Program Manager) Blog

"Without the parent AVHD there is no way to get the data from the child AVHD."

You need to get that parent VHD if at all possible. Be very careful with disk intensive operations which may overwrite or corrupt the deleted file. The programmer in me says you 'may' be able to parse the child VHD as a byte stream and look for markers for a specific file and somehow recover files, but it isn't a likelyhood.

3
  • I'd suspected that the differential disk only holds a copy of changed blocks and not any kind of real filesystem (otherwise it would only be able to support specific filesystems that it knew about) which would mean that the original disk would be needed to recover anything worthwhile. Going on with your idea of "parsing" the VHD for specific files it may be possible to use Recuva to scan the entire drive which may find the files in the VHD but I suspect it would only find the specific filetypes it can search for (jpegs, and a few other select documents)
    – Mokubai
    May 11, 2010 at 11:29
  • Definitely try WinUndelete, it is small, no-install and supports all file types (including VHDs). This little utility has saved me multiple times in the past where others haven't. If you need any further assistance with recovery just let me know.
    – Aaron
    May 11, 2010 at 11:55
  • I've tried WinUndelete but it didn't found my file. This is not suprising to me because I needed this free space for other files - so I probably overwritten it
    – SeeR
    May 11, 2010 at 13:44
0

I suspect you'd have to find out a lot about the internal workings of the vhd file or somehow mount it, maybe vhdmount or WinMount or something like that would work... I've no idea if it would need the original disk as I don't know the details of what is stored in the differential disk.

I'm assuming that Recuva to find and restore the original file is not possible as if you were that low on space you were filling it back up with other data so the original is lost.

0

I found a program called MediaHeal for Virtual drives and after scanning my different vhd with it, it seems like I can restore my files. The demo version only restores the folder/file structure, but it proves that it can somehow decode those differences into NTFS.

enter image description here

I have an easy mind now that I know it's possible. This tool costs $199. If anyone knows something cheaper/free I'm open for suggestions!

3
  • The fact that this program can show the directory structure is not proof that it can restore your files (even the ones it shows). It might work for files that were never on the original parent vhd, but may have only part of a file (the changes) for others. PS. Since the parent VHD should not have changed since it was first installed, any backup in the last two years should work.
    – sgmoore
    May 11, 2010 at 14:10
  • @sgmoore Fortunately this is exactly my case. Parent vhd was clean XP SP3. All the rest was on the differencing vhd.
    – SeeR
    May 11, 2010 at 14:17
  • Try WinImage (free), I use it to recover/repair damaged .vhd and .vud's
    – Joe R.
    Jul 6, 2011 at 17:51
0

This reference may also help you:

    Implementing a Differencing Hard Disk 
    
    A differencing hard disk stores the file locator of the parent hard disk inside the differencing hard disk itself. When a virtual machine tries to open a differencing hard disk, both the differencing hard disk and the parent hard disk are opened. The parent hard disk can also be a differencing hard disk, in which case there could be a chain of differencing hard disks which finally end in a non-differencing hard disk. 
    To have the ability to move hard disks across platforms, the hard disk format is designed in such a way that it can store parent hard disk file locators for different platforms at the same time.
    The parent locator table is used only by the differencing hard disks, as described in “Dynamic Disk Header Format” earlier in this paper. The parent locator table stores a platform code for every parent file locator stored in the file. The virtual machine reads the appropriate parent file locator for the current platform and opens the hard disk image. 
    In Windows, there are two types of platform locators: W2ku and W2ru. The former is the absolute pathname of the parent hard disk, and the latter is a pathname to the parent hard disk relative to the differencing hard disk. 
    For example, a parent hard disk image located in the root drive on a typical Windows-based machine would be stored as follows:

    Type    Example
    W2ku    c:\directory\parent.vhd
    W2ru    .\directory\parent.vhd
    
    As an example on a typical Apple Macintosh-based machine, the parent hard disk image would be stored as follows:

    Type    Example
    Mac (Mac OS alias stored as a blob)
    MacX    file://localhost/directory/parent.vhd
    
    The advantage of the relative pathname is that it allows portability of the differencing and parent hard disk to different locations. With the absolute pathname, whenever the parent hard disk is moved, the parent and child hard disks must be explicitly re-linked. 
    
    When a differencing disk is being created, pathnames for both types of platform locators on the respective platforms should be initialized if possible.
    Note: Versions previous to Microsoft Virtual PC 2004 only stored the absolute pathnames.

    Write Operation for a Differencing Hard Disk
    For a write operation, all data is written to the differencing hard disk image. The block bitmap is marked dirty for all the sectors written to the particular block.

    Read Operation for a Differencing Hard Disk
    When a virtual machine reads sectors of a hard disk image, the differencing hard disk subsystem checks the block bitmap in the differencing hard disk. The differencing hard disk subsystem reads the sectors marked dirty from the differencing hard disk and the sectors marked clean from the parent hard disk.
    For example, consider a block that holds sectors 4096 through 8191 in both the parent and child hard disk image. The first sector of the block holds the bitmap for the block. A single cell represents a bit in the bitmap and a black dot represents the particular sector in the block has been written to by the virtual machine.
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .