I spent the past weekend creating a VirtualBox instance with the perfect setup. Once I was finished I tried to tar+gzipi the virtualbox for sharing with others, and I accidentally ran the following:

kamilski81:~/Documents/Virtual Machines.localized:ruby-1.9.3:$ ll
total 18450696
-rw-r--r--@  1 kamilski81  staff        6148 Aug 13 09:23 .DS_Store
-rw-------   1 kamilski81  staff  **9446748160 Aug 12 22:21 UbuntuAndroid.vdi**
drwxr-xr-x   5 kamilski81  staff         170 Aug  9 10:33 .
drwx------+ 21 kamilski81  staff         714 Aug  8 08:48 ..
drwxr-xr-x   9 kamilski81  staff         306 Oct 23  2009 .localized
kamilski81:~/Documents/Virtual Machines.localized:ruby-1.9.3:$ tar -czvf UbuntuAndroid.vdi U.tar.gz
tar: U.tar.gz: Cannot stat: No such file or directory
tar: Error exit delayed from previous errors.
kamilski81:~/Documents/Virtual Machines.localized:ruby-1.9.3:$ tar -czvf U.tar.gz UbuntuAndroid.vdi
a UbuntuAndroid.vdi
kamilski81:~/Documents/Virtual Machines.localized:ruby-1.9.3:$ ll
total 32
drwxr-xr-x   6 kamilski81  staff   204 Aug 13 09:28 .
-rw-r--r--   1 kamilski81  staff   199 Aug 13 09:28 U.tar.gz
-rw-------   1 kamilski81  staff    45 Aug 13 09:28 UbuntuAndroid.vdi
-rw-r--r--@  1 kamilski81  staff  6148 Aug 13 09:23 .DS_Store
drwx------+ 21 kamilski81  staff   714 Aug  8 08:48 ..
drwxr-xr-x   9 kamilski81  staff   306 Oct 23  2009 .localized

After looking at my files I quickly realized that I may have just overwritten the .vdi file I have created. Do you guys see any way to revert this action? Any help would be greatly appreciated. Thanks.

  • redid the work! thx – Kamilski81 Aug 14 '12 at 18:32

First, you should immediately stop writing any data to your disk. If you have any background programs (including web browsers) that may be doing any kind of disk writing, stop them NOW.

There's no guaranteed way to "undelete" files that are unlinked, because by definition, once the file is unlinked or truncated, the blocks that it was occupying are now part of the disk's "free" pool... in other words, those blocks could be overwritten by incoming writes at any time. That is why you need to stop anything from writing to your disk right now. If you've been using the system and doing significant I/O since, then there's a very high probability that one or more of the sectors have already been overwritten, unless you have a very large disk.

Grab an "undelete" program for your operating system. Ensure it is compatible with whatever filesystem you are using. Rather than installing the undelete program on your native OS, remove the disk and mount it in another computer. Then, use the undelete program from the system you attached the disk to. Most operating systems other than Windows will not do any writes to the disk when it's connected to the system. Windows may write thumbs.db files for thumbnails. I don't recommend trying to recover from a Windows box unless you have Autorun, thumbnails, and Windows Search (Indexing service) turned off completely.

If you have boot camp and Windows installed on a separate partition on a Mac, that may be a valid way to go without having to move your hard drive to another PC. But like I said, make sure you turn off thumbnail generation and the indexing service, as well as any virus scanners -- anything that could potentially touch that data.

If you're using a web browser within the same operating system / partition where you did this, you need to stop right now.... actually it's probably already too late, because browsers such as Firefox, Chrome and Safari store large cache databases and profile information databases that cause very frequent, small writes to the disk. The filesystem could have very easily decided to place one of those incoming writes (such as a cache of the page you're reading right now) onto a block that used to be part of your VDI. So if that happened, the file will be corrupted, and almost completely unrecoverable.

There are ways to read what data used to be on the drive, if you are a data recovery expert with very sensitive and expensive tools -- but us mortals who wield commonly-available software stop being able to recover the data once one or more of the blocks of the file in the free pool have been written over.


If the file is actually found in the trash bin, and you remove it using the UI, you're home free. If you recover the file by any other means, how can you ever have any confidence that it's not damaged in some non-obvious way? It's one thing to recover a small file or one you can visually verify is probably intact, quite another to pick up a gigabyte and hope for the best.

I recommend you don't waste your time. Just redo the work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.