[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-discuss] Any way to recover after qemu-img snapshot -a? despar

From: Jakob Bohm
Subject: Re: [Qemu-discuss] Any way to recover after qemu-img snapshot -a? desparate!
Date: Fri, 29 May 2015 12:07:18 +0200
User-agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0

On 29/05/2015 11:55, Aaron Williams wrote:
First some background,

I managed to screw up a VM running an older version of Ubuntu so it
wouldn't boot and was going to attempt to fix it by restoring the boot
partition from an earlier snapshot. Unfortunately I didn't fully read
the documentation saying that it would blow away anything newer than the
snapshot. In any event, at this point it looks like all data is lost.

What happened is that my snapshot list looks something like this
according to qemu-img snapshot -l:

Snapshot list:
ID        TAG                 VM SIZE                DATE       VM CLOCK
                                     0 1969-12-31 16:00:00   00:00:00.000
                                     0 1969-12-31 16:00:00   00:00:00.000
                                     0 1969-12-31 16:00:00   00:00:00.000
1         broken-boot               0 2015-05-29 00:56:26   00:00:00.000

I had made some earlier snapshots, but those were created through
virt-manager and it didn't insert the proper labels in the qcow2 image.

I later learned that virsh shows the following:
Name                 Creation Time             State
  Broken               2015-05-29 01:06:03 -0700 shutoff
  post-con 2014        2014-11-22 02:44:45 -0800 running
  snapshot1            2015-04-06 12:23:14 -0700 running
  Working              2014-11-07 00:32:45 -0800 running

In any event, I issues the following command which seems to have totally
nuked everything. I backed up the qcow2 file, unfortunately it was not
before I did this:

qemu-img snapshot -a "" vm1.qcow2

Is there any way I can recover either my "snapshot1" or "Broken" image
from the qcow2 file or is all the data forever lost? There is a lot of
critical data here.

I should have read the man pages and backed up the file before I started
this but one doesn't always think straight when suffering from the flu.

Step 1: Save everything, back ups at every step from
  here forward.

Step 2: Recover from the flu, the rest needs a very
  clear head.

Step 3: In COPIES of the qcow2 file, try restoring to
  each of the nameless snapshots, then check if any of
  those contain your data

Step 4: Read the qcow2 file format specification.

Step 5: Use a hex editor or other low level tools to
  examine a COPY of your backed up qcow2 files.

Step 6: Look for traces of: Old (now unused) sectors
  listing mappings from virtual disk sectors to file
  offsets for older data.

Step 7: Look for file offsets/sectors no longer
  referenced by the currently active (incomplete)

Step 8: Try to reassemble the unreferenced file
  offsets/sectors into your missing data, either
  as a disk image or as files.

Step 9: This becomes a lot harder if Ubuntu was
  encrypting its (virtual) disks, as you are then
  looking for encrypted sectors that all look alike.

Hope for the best...

Jakob Bohm, CIO, Partner, WiseMo A/S.  https://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark.  Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded

reply via email to

[Prev in Thread] Current Thread [Next in Thread]