Recover deleted files in a Virtual Disk

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
ragnazorg
Posts: 5
Joined: 21 Mar 2012, 12:51

Recover deleted files in a Virtual Disk

#1 Post by ragnazorg »

Hi I am using xen server and I am running vm on it with virtual drive.

Suddenly the virtual drive got compromised and I dont know what to do when the hacker rm -rf /
and deleted most of my files.

How am I going to recover it? i already mounted the drive and I can't see my files anymore.

Can I still recover the said files I need? they are mostly 300++mb files.

Thanks in advance.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recover deleted files in a Virtual Disk

#2 Post by Fiona »

Did you check TestDisk version 6.14 and the menu Undelete?
Confirm in TestDisk through until you see the menu Analyse.
Before, your affected disk must be selected.
If you have a virtual drive, it should be mounted and might appear in TestDisk disk selection as drive?
In case let me know.
Don't confirm at Analyse, but Advanced.
Check the menu Undelete and press enter.
Do you find your files there?
You can copy them to another intact drive.
You'll find the commands at the bottom of the screen.

If you don't find your files, PhotoRec might be worth a try.

ragnazorg
Posts: 5
Joined: 21 Mar 2012, 12:51

Re: Recover deleted files in a Virtual Disk

#3 Post by ragnazorg »

Is it ok to use 6.13 24?

or what should I really use,

I have downloaded some file its in recup_dir but im wondering because the tar.gz files which is 300mb files I have isnt available?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recover deleted files in a Virtual Disk

#4 Post by Fiona »

Can you test it using TestDisk or PhotoRec 6.14?
It looked like that you used PhotoRec 6.13?
Another good idea might be, go in PhotoRec to File Opt and press s to deselect all file types.
Then select only your required ones.

Fiona

ragnazorg
Posts: 5
Joined: 21 Mar 2012, 12:51

Re: Recover deleted files in a Virtual Disk

#5 Post by ragnazorg »

Yes i did that but it gave me small files not the 300mb++ ones.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Recover deleted files in a Virtual Disk

#6 Post by Fiona »

What kind of file type did you try to recover?

ragnazorg
Posts: 5
Joined: 21 Mar 2012, 12:51

Re: Recover deleted files in a Virtual Disk

#7 Post by ragnazorg »

trying to recover .tar.gz

Locked