recover of raw files from a kvm virtual machine

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
eferrari
Posts: 1
Joined: 08 Sep 2014, 17:23

recover of raw files from a kvm virtual machine

#1 Post by eferrari »

Hi,

i deleted two virtual machines which were created with kvm. I used the "raw"-format to store the virtual machines. Now they are gone. The raw format is just an image of the disk. More information here: http://www.inett.de/wiki/KVM_Images_mounten . Does photorec recognizes this format ? I think that the raw-format is the same as images from harddisks created with dd. If photorec does not know this format, is there a possibility that it can "learn" it ?

Thanks for any information.


Bernd

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: recover of raw files from a kvm virtual machine

#2 Post by cgrenier »

PhotoRec can recover images using the qcow and qcow2 file formats.
You can use a custom signature in .photorec.sig to search for the raw files

Code: Select all

raw 510 0x55 0xAA
http://www.cgsecurity.org/wiki/Add_your ... o_PhotoRec

Locked