cgsecurity.org

Hi there,

I would like to have some help with recovering a .vdi file. I deleded it by accident and would like it back because this is a data disk. Since I'm not really used to this kind of thing (normally I'm very careful) I need some help to understand this.

Let me give you some information about my system:
- OS: Linux Mint 15 (Olivia) Cinnamon
- 3 HDD's:
Disk 1: 500 Gb (EXT4) partition for OS and store other stuff in my /home directory.
Disk 2: 1 Tb partition (NTFS) for backup purposes (films, series, software, etc)
Disk 3: 1 Tb partition (EXT4) for storing VM's

The problem exists in Disk 3. I was using Virtualbox and wanted to switch to VMware Workstation 10. So after converting the disks needed for running in vmware (from .vdi to .vmdk) I did not need the disks from Virtualbox anymore. To save space I deleted them from Virtualbox. In a rush I also deleted the Virtual Machine where my data like documents and photo's are stored. This file was about 500 Gb (friends and family used it too) for storing data. The virtual machine was consisting of two disks, the OS disk and the data disk. The OS disk is saved and converted.

Can someone help me to recover or undelete the 500 Gb .vdi file?

I already had Photorec running and recovered a lot of files included three .vdi files. However, I do not know what to do now. How do I restore the 500 Gb file?

Kind regards,

The ancient one

Alright, I have like 180 files of .vdi files. Are those files fragments or just single file? If they are fragments, how do I recover them?

It seems that I found what I was looking for but there are some thing I would like to understand.

I found a .vdi file which physical size is 2,1 Mb, however, when I mount it in a virtual machine then it says that its virtual size is 500 Gb. It also says this:
The command suggested:
The filesystem was EXT4. What do I do now? Is it fragmented? Do I run it again searching for more?

Can someone please answer me? How can I recover the files I need?

PhotoRec create a new .vdi each time a VDI signature is seen. AFAIK you can't use mount to mount a vdi file, you need to attach the file as a virtual disk, start a VM with a working OS and mount the filesystem inside the VM. If the original file was fragmented, it will probably fail.

Thank you for replying! That is the thing, it was a 500Gb file, so the real question here is... Is there a pot of glue somewhere so that I can fix this?

I already knew about the .vdi files and mounting in a VM. I did find the .vdi in question but it seems that it is just about 2,1 Mb of size. When I mount it, it tells me that it's virtual size is 500 Gb. The remaining pieces are missing or so it seems.

Is it possible to recover this?

The file about 24 Gb filled of data.

Disable all other file formats in [File Opt], start a recovery, maybe this time, you will get a larger file...

Hi,

Thanks for your reply. I already did this and it finds a lot of .vdi files which are no bigger then 3,2 Gb and the smallest is like 86 Kb or so. Also when trying to mount those volumes it says there are duplicate UUID's in play and cannot be mounted.

Hi!

Maybe I'm happy after all! It really depends on the answer of the question I have.

I found what like to be a ton of photo's which were stored in a .VDI file. Does photorec or testdisk read inside the .VDI file and recover any photo's or other files in it?

The .vdi file contains compressed and/or unaligned and/or fragmented data files. It's why PhotoRec doesn't recover the jpg inside the the vdi file.