Re: [Qemu-discuss] Any way to recover after qemu-img snapshot -a? desparate!

[Jakob Bohm]

On 29/05/2015 11:55, Aaron Williams wrote:
> First some background,
>
> I managed to screw up a VM running an older version of Ubuntu so it
> wouldn't boot and was going to attempt to fix it by restoring the boot
> partition from an earlier snapshot. Unfortunately I didn't fully read
> the documentation saying that it would blow away anything newer than the
> snapshot. In any event, at this point it looks like all data is lost.
>
> What happened is that my snapshot list looks something like this
> according to qemu-img snapshot -l:
>
> Snapshot list:
> ID        TAG                 VM SIZE                DATE       VM CLOCK
>                                      0 1969-12-31 16:00:00   00:00:00.000
>                                      0 1969-12-31 16:00:00   00:00:00.000
>                                      0 1969-12-31 16:00:00   00:00:00.000
> 1         broken-boot               0 2015-05-29 00:56:26   00:00:00.000
>
> I had made some earlier snapshots, but those were created through
> virt-manager and it didn't insert the proper labels in the qcow2 image.
>
> I later learned that virsh shows the following:
> Name                 Creation Time             State
> ------------------------------------------------------------
>   Broken               2015-05-29 01:06:03 -0700 shutoff
>   post-con 2014        2014-11-22 02:44:45 -0800 running
>   snapshot1            2015-04-06 12:23:14 -0700 running
>   Working              2014-11-07 00:32:45 -0800 running
>
> In any event, I issues the following command which seems to have totally
> nuked everything. I backed up the qcow2 file, unfortunately it was not
> before I did this:
>
> qemu-img snapshot -a "" vm1.qcow2
>
> Is there any way I can recover either my "snapshot1" or "Broken" image
> from the qcow2 file or is all the data forever lost? There is a lot of
> critical data here.
>
> I should have read the man pages and backed up the file before I started
> this but one doesn't always think straight when suffering from the flu.
Step 1: Save everything, back ups at every step from
  here forward.

Step 2: Recover from the flu, the rest needs a very
  clear head.

Step 3: In COPIES of the qcow2 file, try restoring to
  each of the nameless snapshots, then check if any of
  those contain your data

Step 4: Read the qcow2 file format specification.

Step 5: Use a hex editor or other low level tools to
  examine a COPY of your backed up qcow2 files.

Step 6: Look for traces of: Old (now unused) sectors
  listing mappings from virtual disk sectors to file
  offsets for older data.

Step 7: Look for file offsets/sectors no longer
  referenced by the currently active (incomplete)
  image.

Step 8: Try to reassemble the unreferenced file
  offsets/sectors into your missing data, either
  as a disk image or as files.

Step 9: This becomes a lot harder if Ubuntu was
  encrypting its (virtual) disks, as you are then
  looking for encrypted sectors that all look alike.

Hope for the best...

Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S.  https://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark.  Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded