Page 1 of 1

Recover deleted files in a Virtual Disk

Posted: 21 Mar 2012, 13:20
by ragnazorg
Hi I am using xen server and I am running vm on it with virtual drive.

Suddenly the virtual drive got compromised and I dont know what to do when the hacker rm -rf /
and deleted most of my files.

How am I going to recover it? i already mounted the drive and I can't see my files anymore.

Can I still recover the said files I need? they are mostly 300++mb files.

Thanks in advance.

Re: Recover deleted files in a Virtual Disk

Posted: 21 Mar 2012, 14:34
by Fiona
Did you check TestDisk version 6.14 and the menu Undelete?
Confirm in TestDisk through until you see the menu Analyse.
Before, your affected disk must be selected.
If you have a virtual drive, it should be mounted and might appear in TestDisk disk selection as drive?
In case let me know.
Don't confirm at Analyse, but Advanced.
Check the menu Undelete and press enter.
Do you find your files there?
You can copy them to another intact drive.
You'll find the commands at the bottom of the screen.

If you don't find your files, PhotoRec might be worth a try.

Re: Recover deleted files in a Virtual Disk

Posted: 21 Mar 2012, 14:50
by ragnazorg
Is it ok to use 6.13 24?

or what should I really use,

I have downloaded some file its in recup_dir but im wondering because the tar.gz files which is 300mb files I have isnt available?

Re: Recover deleted files in a Virtual Disk

Posted: 21 Mar 2012, 15:31
by Fiona
Can you test it using TestDisk or PhotoRec 6.14?
It looked like that you used PhotoRec 6.13?
Another good idea might be, go in PhotoRec to File Opt and press s to deselect all file types.
Then select only your required ones.

Fiona

Re: Recover deleted files in a Virtual Disk

Posted: 21 Mar 2012, 15:35
by ragnazorg
Yes i did that but it gave me small files not the 300mb++ ones.

Re: Recover deleted files in a Virtual Disk

Posted: 21 Mar 2012, 20:28
by Fiona
What kind of file type did you try to recover?

Re: Recover deleted files in a Virtual Disk

Posted: 21 Mar 2012, 23:01
by ragnazorg
trying to recover .tar.gz