I have a Virtualbox VM on an hard disk that failed. The only thing I could recover from the disk was a snapshot of the dynamic VDI disk used by the VM, and I could only recover the first half of the file. It still contains the VDI header, the VDI block map, and a good amount of blocks.
I am only interested in recovering a few files, and since I was working on them before the failure, and they were smaller than the VDI block size (1Mb) then I suspect the data for them is present in the snapshot. I can in fact grep for it and find pieces of it, but the blocks in the snapshot are not ordered in logical order.
But since it's not a full VDI file, tools like virtualbox-fuse or libguestfs refuse to work with it, so I have to write my own forensic script.
What I don't understand is how the VDI block map works and how to write a script that will extract the blocks that are still present in the part of the VDI I have and rewrite them in logical order (perhaps filling the unallocated or missing space with an easily recognizable byte pattern)
