Page 1 of 1

cow - qcow2

Posted: 16 Oct 2016, 10:22
by kwerner
Good day,

it has been asked before. But I don't get the answer.
I need to recover qcow2 files that hold my VMs created with qemu-img. Photorec (tested different versions) does find *.cow files but many more than I originally had and of very small size. The ones I am looking for are about 80GB.
Is it possible to 'recreate' my original qcow2 files?

For your information, this is how I got into this mess:
My server had two 3TB disks in software raid (Debian jessie). On disk failed and was replaced. In order to reassamble my raid, I had to copy the partition table from the still working to the new disk. I used sgdisk. I assumed wrongly sgdisk would copy from <source> to <target>. But no. It is the other way round. The manpage is not a big help either. Whatever.
This is all that happened. No corruption or other failures on the good drive.
After this I used ddrescue to copy all data from the good drive to the new one in order to protect the original data. Also used testdisk to search for the lost partitions. It finds them and recognizes them as software raid. But when I used these to write a new partition table and rebooted, I couldn't mount them. Neither directly nor via assembly through mdadm. So I tried to recover the imported files.

Re: cow - qcow2

Posted: 17 Oct 2016, 06:26
by cgrenier
Do you still get too many .cow files if you disable the other file formats ?
I am not familiar enough with qcow internal to know if the file header can be found several times in the file itself.

Re: cow - qcow2

Posted: 17 Oct 2016, 10:53
by kwerner
Will try with a new copy. Right now ddrescue is still running. Maybe without using testdisk at all.

Re: cow - qcow2

Posted: 17 Oct 2016, 12:35
by kwerner
ddrescue completed. Status:
---
PhotoRec 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sda - 3000 GB / 2794 GiB (RO) - ST33000650NS
Partition
Start
End
Size in sectors
No partition
0
0 1 364801 80 63 5860533168 [Whole disk]
Pass 0 - Reading sector 608915892/5860533168, 8/10 headers found
Elapsed time 0h33m10s - Estimated time to completion 4h46m02
---
"8/10 headers found" Could you please elaborate on this?

Also ran 'testdisk' again. The partition table that got acciedently copied was definetely gpt, however I am not sure whether the old one was. Although the disks are 3TB, none of the partitions were bigger than 2TB. So, it could also have been an mbr table (correct me, if I am wrong).
My partitions are found and identified as Linux Raid with both mbr and efi/gpt method.

Re: cow - qcow2

Posted: 17 Oct 2016, 13:30
by kwerner
Looking good so far:

root@rescue ~ # l /mnt/recover3/recup_dir.1/
total 33G
-rw-r--r-- 1 136734 136734 3.1G Oct 17 14:24 f165515264.cow
-rw-r--r-- 1 136734 136734 9.2G Oct 17 14:27 f171855872.cow
-rw-r--r-- 1 136734 136734 196K Oct 17 14:07 f43520000.cow
-rw-r--r-- 1 136734 136734 196K Oct 17 14:07 f43520392.cow
-rw-r--r-- 1 136734 136734 196K Oct 17 14:07 f43520784.cow
-rw-r--r-- 1 136734 136734 196K Oct 17 14:07 f43521176.cow
-rw-r--r-- 1 136734 136734 59G Oct 17 14:23 f43521568.cow
-rw-r--r-- 1 136734 136734 2.6K Oct 17 14:25 report.xml

Re: cow - qcow2

Posted: 17 Oct 2016, 14:10
by kwerner
I don`t want to be overly verbose but it might help someone else.
This is what is happening right now.
---
root@rescue ~ # l /mnt/recover3/recup_dir.1/
total 33G
-rw-r--r-- 1 136734 136734 3.1G Oct 17 14:24 f165515264.cow
-rw-r--r-- 1 136734 136734 79G Oct 17 14:49 f171855872.cow
-rw-r--r-- 1 136734 136734 196K Oct 17 14:07 f43520000.cow
-rw-r--r-- 1 136734 136734 196K Oct 17 14:07 f43520392.cow
-rw-r--r-- 1 136734 136734 196K Oct 17 14:07 f43520784.cow
-rw-r--r-- 1 136734 136734 196K Oct 17 14:07 f43521176.cow
-rw-r--r-- 1 136734 136734 59G Oct 17 14:23 f43521568.cow
-rw-r--r-- 1 136734 136734 2.6K Oct 17 14:25 report.xml
---
PhotoRec 7.1-WIP, Data Recovery Utility, August 2016
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Disk /dev/sda - 3000 GB / 2794 GiB (RO) - ST33000650NS
Partition Start End Size in sectors
No partition 0 0 1 364801 80 63 5860533168 [Whole disk]
Destination /mnt/recover3/recup_dir
Pass 1 - Reading sector 292842720/5860533168, 6 files found
Elapsed time 1h52m45s - Estimated time to completion 35h43m39
cow: 6 recovered
---
Files in recup_dir are growing in size. About 140GB altogether as shown by ls. But ls also says that the whole directory holds only 33GB and that hasn't changed for quite some time.
Also photorec says it recovered 6 files but 7 .com files are in recup_dir.

Re: cow - qcow2

Posted: 20 Oct 2016, 11:57
by kwerner
I ended up with about 40 .cow files ranging in size between a few KB and 1.7TB, none was usable.
qemu-img info and check even didn't complain about any errors with a few files. Still no t-shirt.

Will give testdisk another try.