Page 1 of 1

questions on recovering a .vdi file

Posted: 09 May 2018, 22:13
by genterminl
I had a 200GB ext4 partition (root partition for Artix Linux) with VirtualBox installed, and a vdi file for a Windows 7 install. I stupidly reformatted the partition while dealing with Artix related issues. I cloned (dd) the partition before installing too much in it, so I was hoping to recover the vdi file. My first run of photorec did recover one vdi file

Code: Select all

ls *vdi
-rw-r--r-- 1 jack jack 4096 May  7 17:21 f59355136.vdi
but the file command says

Code: Select all

file *vdi
f59355136.vdi: VirtualBox Disk Image, major 1, minor 1 (<<< Oracle VM VirtualBox Disk Image >>>), 53687091200 bytes
Am I correct to assume that the file is only 4K because that is the block size used, and photorec has no way of knowing that the following blocks are (might be) part of the file? I also assume the byte size (50GB) in the "file" output is from within the file itself - although I think that was the defined size of the file image - I'm quite sure it wasn't actually that large.

My main question is whether there is any hope of recovering most or at least more of that file. Does the actual file name in any way reflect something like the block number? If so, could I use that to craft a "dd" command, trying increasing sizes, and then see if a new Win 7 image in VBox can successfully mount it?

Thanks for any information, or even pointers the the section of the docs I obviously missed.