questions on recovering a .vdi file

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
genterminl
Posts: 1
Joined: 09 May 2018, 20:48

questions on recovering a .vdi file

#1 Post by genterminl »

I had a 200GB ext4 partition (root partition for Artix Linux) with VirtualBox installed, and a vdi file for a Windows 7 install. I stupidly reformatted the partition while dealing with Artix related issues. I cloned (dd) the partition before installing too much in it, so I was hoping to recover the vdi file. My first run of photorec did recover one vdi file

Code: Select all

ls *vdi
-rw-r--r-- 1 jack jack 4096 May  7 17:21 f59355136.vdi
but the file command says

Code: Select all

file *vdi
f59355136.vdi: VirtualBox Disk Image, major 1, minor 1 (<<< Oracle VM VirtualBox Disk Image >>>), 53687091200 bytes
Am I correct to assume that the file is only 4K because that is the block size used, and photorec has no way of knowing that the following blocks are (might be) part of the file? I also assume the byte size (50GB) in the "file" output is from within the file itself - although I think that was the defined size of the file image - I'm quite sure it wasn't actually that large.

My main question is whether there is any hope of recovering most or at least more of that file. Does the actual file name in any way reflect something like the block number? If so, could I use that to craft a "dd" command, trying increasing sizes, and then see if a new Win 7 image in VBox can successfully mount it?

Thanks for any information, or even pointers the the section of the docs I obviously missed.

Locked