Recovering a partition that had a VM Topic is solved

[Deleted User 13634]

Hi everyone,

I accidentally deleted the only partition on my secondary hard drive, nothing essential on there but would be nice to have the files back. The hard drive contained a mac vm- testdisk gets to this and recognises it as "mac hfs" and at the quick search results screen shows a bunch of "mac hfs" partitions, which obviously were not actually on the disk and were part of the vm file. Quick search said it couldn't recover the rest of the partition (I dont recall the exact message sorry!).

I'm currently waiting for the deep search to finish but it's still showing mac hfs sectors and a couple of linux ones (potentially left over from an old install or vm). The mac vm is NOT among the files I want to recover if that helps any answer. I do know the file types for the files I want back but would have preferred to have the whole drive back, so figured TestDisk was the better option.

Is there a "I have a vm ignore this" button? Is my only option using photorec and forgetting about the other files? Any advice at all?

[recuperation]

Hi everyone,

I accidentally deleted the only partition on my secondary hard drive, nothing essential on there but would be nice to have the files back. The hard drive contained a mac vm- testdisk gets to this and recognises it as "mac hfs" and at the quick search results screen shows a bunch of "mac hfs" partitions, which obviously were not actually on the disk and were part of the vm file. Quick search said it couldn't recover the rest of the partition (I dont recall the exact message sorry!).

I'm currently waiting for the deep search to finish but it's still showing mac hfs sectors and a couple of linux ones (potentially left over from an old install or vm). The mac vm is NOT among the files I want to recover if that helps any answer.

I don't understand. Where exactly? Inside one of the found partitions?

I do know the file types for the files I want back but would have preferred to have the whole drive back, so figured TestDisk was the better option.

Is there a "I have a vm ignore this" button?

No.

Is my only option using photorec and forgetting about the other files? Any advice at all?

Yes.
11 years ago I accidentally formated a drive that contained a couple of virtual machines. To my surprise Testdisk found lots of partitions on my drive that never had lots of partitions.
Years later I suddenly realized that I must have found the vmware disk files. I assume that each of those disks contain an image of a full disk. And Testdisk correctly finds partitions inside.

If I ever are to rescue that drive I would rather simulate the partitioning and formating process on a drive with the same size under the same operating system to see where my partition started and where the backup boot sector had been placed.

[Deleted User 13634]

Your final example is the situation I'm experiencing. I don't have a second drive big enough to go about cloning the drive and sorting through that way. The disk was originally some assorted leftover efi/windows recovery partitions from when it was my main drive, then a big singular NTFS that I dropped files on at random. The Mac VM was created and run entirely from that big partition. Testdisk doesn't seem to be able to understand this, and instead separates out the mac filesystem "partitions" (that were not actually partitions on the disk but part of the virtual machine file) rather than recognising the big NTFS partition that was actually there.

Hopefully when I wake up the scan will have magically fixed itself /: not holding out much hope! Thanks anyway!

EDIT: Attaching screenshot in case it helps some future user. I interrupted the scan accidentally so had to restart. As far as I'm aware the drive was in good health before I messed about with it so o idea what these errors are.

Annotation 2020-07-11 224221.png (48.31 KiB) Viewed 2756 times

[recuperation]

Your final example is the situation I'm experiencing. I don't have a second drive big enough to go about cloning the drive and

Plase start your recovery efforts once you have at least on new drive unless you are only playing around with your broken drive and final loss of data does not matter for you. Being able to undo manipulations and being at beginner level is a situation prone for data loss.

sorting through that way. The disk was originally some assorted leftover efi/windows recovery partitions from when it was my main drive, then a big singular NTFS that I dropped files on at random. The Mac VM was created and run entirely from that big partition. Testdisk doesn't seem to be able to understand this, and instead separates out the mac filesystem "partitions" (that were not actually partitions on the disk but part of the virtual machine file) rather than recognising the big NTFS partition that was actually there.

This is interesting. As NTFS file data starts with the marker "FILE" file data never starts with an offset of zero with regards to a cluster. Partition data does. From my limited knowledge it should be possible to make the distinction.

[Deleted User 13634]

I'm a computer science student, its my job to play with stuff I don't understand :p Worst case scenario here is I have a clean hdd, this wasn't being used as a boot drive.

But hey, I left it overnight and it worked! It gave a short list of partitions it supposedly couldn't recover, then amongst the partitions it could- my big NTFS drive : ) I chose to write only that and a linux partition it found and could see the filesystem of. I thought it might be a vm I forgot about.

Poking through the files it looks like everything was recovered. The mac vm is apparently completely fine! Boots and everything! There is no sign of a linux vm, I don't think there ever was one. Instead...

Annotation 2020-07-12 130156.png (16.14 KiB) Viewed 2712 times

It's recovered an ubuntu install I had over 2 years ago. This software is magic, how the hell is that still intact! I don't really understand efi and didnt want it in the first place so I won't bother trying to rebuild it.

For comparison, a screenshot I took a couple days ago (I swapped the drive order since (can also see I reinstalled windows which is why I was deleting partitions in the first place)):

107385850_566519464033125_289122450356274931_n.png (13.89 KiB) Viewed 2712 times

Thank you for your help : ) I hope my post helps some person in the future.