crypt-LUKS file system - file recovery Topic is solved

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
maqsood
Posts: 5
Joined: 23 Nov 2013, 13:16

crypt-LUKS file system - file recovery

#1 Post by maqsood »

Hi All,

I am a new bee to the forum, I came up with this strange incident or rather accident, where my KVM(Win 7) got deleted :cry: I have been trying to recover this but no go... The image file (*.Qcow2) which is the actually file for VM stored at location /var/lib/libvirt/images/ need to be recovered, I tried using TestDisk, and I'm able to see the file and some how recovered the file, but its of size 579 bytes, its supposed to be of size 100GB(as my KVM disk size I gave is 100gigs while creating the VM) any idea whats happening.......... I have loads of data in this VM which I need very badly, please help me out. Operating system is Open client Redhat 64 with 8Gb ram Intel core i5 vpro processor and 320GB HDD

It all happened in fraction of seconds, kvm got deleted, and the image file gone!! I have to recover it at any cost... please help :geek:

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: crypt-LUKS file system - file recovery

#2 Post by cgrenier »

It looks like the file has been overwritten by a new very small file.
PhotoRec should be able recover the .qcow2 file (recovered file will be larger than original) but if the file was fragmented, the recovered file will be broken and you may not be able to mount it.

maqsood
Posts: 5
Joined: 23 Nov 2013, 13:16

Re: crypt-LUKS file system - file recovery

#3 Post by maqsood »

Thank you so much for your quick response...Cgrenier :)
I just started PhotoRec, but it shows estimated time as 35hrs.. will that really take that long, and its OK for me even if I get back my files from that kvm(ex: xls, xlsx etc.,) I don't really need that qcow2 file of size 100Gigs screen shot of progress attached.. I'd be grateful to you if I get what I needed. Thank you :)
Attachments
Screenshot.png
Screenshot.png (79.97 KiB) Viewed 4839 times

maqsood
Posts: 5
Joined: 23 Nov 2013, 13:16

Re: crypt-LUKS file system - file recovery

#4 Post by maqsood »

And initially I thought photorec is to recover only photos :P

maqsood
Posts: 5
Joined: 23 Nov 2013, 13:16

Re: crypt-LUKS file system - file recovery

#5 Post by maqsood »

One more doubt., will photorec read the files from the NTFS filesystem of my KVM?

maqsood
Posts: 5
Joined: 23 Nov 2013, 13:16

Re: crypt-LUKS file system - file recovery

#6 Post by maqsood »

At last, photorec completed recovery process after 13-14 hrs, now I can see recup_dir.1 to recup_dir.9032 folders stored in my home folder, but I'm not able to understand what files are these, and how to extract the originally recovered files from these... could you please help :)

Thanks & Regards
Maqsood

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: crypt-LUKS file system - file recovery

#7 Post by cgrenier »

They are your files (or fragments of your files). PhotoRec can't recover the original filenames, only the data.

Locked