Win 8.1 (host OS) Laptop running Virtual Box. Ubuntu 10.04 Guest machine inside Virtual box. 6 month old snapshot of guest machine and "current state" in use. User was having problems with "current state" machine loading slowly (maybe hanging) and at one point VirtualBox helpfully asked if they'd rather restore snapshot. Not realizing that this would dump their "current state" machine image, they said yes, and have now lost 6 months of data.
Yes, I know, they should have backups. Not helpful at this juncture. Currently I'm looking for recovery options for them
Is there any way to recover/restore the previous "current state" VM from before they agreed to go to the snapshot?
I've got the machine shut down now, so some sort of data recovery may be possible if it's "just" a deleted file I can get back from the host Windows OS.
Any help appreciated, or recommendations for specific file/data recovery tools, or which
vdi file to look for.
Working on the theory that the "current state" was just an other
.vdi file, and that I might find it with generic Windows recovery software, I started looking for possible candidates. A "quick" scan found (and recovered) the
vbox-prev file, but didn't find the
.vdi file. However, the "prev" file gave me the filename of the missing
.vdi file, so that's some progress. I'm now trying a deep scan.
The scan tool I'm using lets me define new file formats to look for in bytes on the disk, but it needs "magic bytes" and an offset and data length. It seems a fine tool, but these advanced search features are not well documented. If anyone has a pointer to the
.vdi file format, that would be great.
For those who may find this later, current
.vdi files all begin with (little endian) bytes that look like this:
0000000 < < < O r a c l e V M V i 0000020 r t u a l B o x D i s k I m 0000040 a g e > > > \n \0 \0 \0 \0 \0 \0 \0 \0
0000000 3c3c 203c 724f 6361 656c 5620 204d 6956 0000020 7472 6175 426c 786f 4420 7369 206b 6d49 0000040 6761 2065 3e3e 0a3e 0000 0000 0000 0000