Restore data from QCow2 missing backing file (data recovery part 4)
30 Nov 2020I have successfully restored data from my QCow2 file with a missing backing file. I wrote lots of C code to be able to convert the QCow2 file into an IMG file. Then I found a software to recover my file from a broken ext4 partition.
WARNING! This is not a replacement for a real backup, and it can only recover files existing in the QCow2 image and not files that are only in the backing file.
Convert QCow2 to IMG
Using my own software to read qcow2 file and write it as an IMG file
./read_qcow2 broken.qcow2 dump.img
Download recovery software
I stumbled upon a software called testdisk, for recovering files and broken partitions/filesystems. It can be found here https://www.cgsecurity.org/wiki/TestDisk_Download
And finally recover some files
First we need to make the IMG file available to the Linux system as if it was a real drive under /dev. This can be done using losetup
losetup /dev/loop0 ~/dump.img
Now we have a /dev/loop0
device under /dev.
but before we start the recovery, make sure you have lots of available disk space. My QCow2 disk (and IMG file) was 50Gb but the restored data I got was ~300Gb before I had to stop it due to full disk. I belive the software will be able to find fragments of old deleted files and restore them too, thats why there is a lot more data than it should be.
Now we can run the recovery software.
cd ~/Downloads
tar xf testdisk-7.2-WIP.linux26-x86_64.tar.bz2
cd testdisk-7.2-WIP/
sudo ./testdisk_static
Replace ~/Downloads
with the folder where you downloaded the recovery software.
/dev/loop0
device
EFI GPT
partition map so I chose that one, if you don’t know you can choose None
or if it is an standard MBR
choose Intel
.
Analyze
Quick Search
to continue
P
to list files
:
to select the files/folders you want to restore. Then press shift + c
to copy selected files.
C
again
You can find the source code for my
read_qcow2
project over at Github: https://github.com/Raddinox/read_qcow2