cgsecurity.org

Hi All,

I am a new bee to the forum, I came up with this strange incident or rather accident, where my KVM(Win 7) got deleted I have been trying to recover this but no go... The image file (*.Qcow2) which is the actually file for VM stored at location /var/lib/libvirt/images/ need to be recovered, I tried using TestDisk, and I'm able to see the file and some how recovered the file, but its of size 579 bytes, its supposed to be of size 100GB(as my KVM disk size I gave is 100gigs while creating the VM) any idea whats happening.......... I have loads of data in this VM which I need very badly, please help me out. Operating system is Open client Redhat 64 with 8Gb ram Intel core i5 vpro processor and 320GB HDD

It all happened in fraction of seconds, kvm got deleted, and the image file gone!! I have to recover it at any cost... please help

It looks like the file has been overwritten by a new very small file.
PhotoRec should be able recover the .qcow2 file (recovered file will be larger than original) but if the file was fragmented, the recovered file will be broken and you may not be able to mount it.

Thank you so much for your quick response...Cgrenier
I just started PhotoRec, but it shows estimated time as 35hrs.. will that really take that long, and its OK for me even if I get back my files from that kvm(ex: xls, xlsx etc.,) I don't really need that qcow2 file of size 100Gigs screen shot of progress attached.. I'd be grateful to you if I get what I needed. Thank you

And initially I thought photorec is to recover only photos

One more doubt., will photorec read the files from the NTFS filesystem of my KVM?

At last, photorec completed recovery process after 13-14 hrs, now I can see recup_dir.1 to recup_dir.9032 folders stored in my home folder, but I'm not able to understand what files are these, and how to extract the originally recovered files from these... could you please help

Thanks & Regards
Maqsood

They are your files (or fragments of your files). PhotoRec can't recover the original filenames, only the data.