Re: recover snapshot

[Pierrick Bouvier]

Hi Jakob,

On 7/18/24 07:50, Jakob Bohm via wrote:
> On 2024-07-16 22:22, Leonel Garcia Rosas wrote:
> > I accidentally delete the backing file. It was a very old 200GB file
> > from 2018. The snapshot is 1 TB and I can't use it.
> > My server is down.
> > I tried to recover the file with all the tools I found (testdisk,
> > photorec, rr-studios) with no luck.
> > I just issue a qemu-img info on the snapshot and the error shows up,
> > and I unmount the partition. Remount in ro and use the tools I
> > mentioned.
> >
> > Is there something I can do to recover the files in the snapshot?
> > It is the /home directory from my server and I have customers waiting
> > for email and stuff.
> >
> > I'll pay for the advice or the service
> > Thanks in advance!
> >
> > Leonel
>
> Well, you deleted all the virtual disk sectors that were unchanged since
> the backing file.
>
> To get back all disk sectors changed since the backing file, just
> repoint the qcow2 image to an all zero backing file .

Interesting, it's an idea I suggested on IRC (where Leonel came first), 
but someone mentioned it would not work.
Will snapshot apply the diff "blindly", without checking src block (in 
backing file) was the one expected?

I don't know the snapshot/qcow2 implementation details, and I wonder if 
there is some kind of checksum regarding the original disk, or simply a 
list of changes (write this block with new content X at addr Y).

> DO NOT CREATE A NEW ALL ZERO 200MB FILE, it might overwrite any locally
> recoverable part of the old backing file.  Instead perform the recovery
> on a different real disk .   Also look at file recovery tools for the
> file system that stored the lost 200MB file.  Ignore any AI Slop
> articles that just tells you, you should have made a backup or installed
> some delete protection software before the mistake.
>
>
> Enjoy
>
> Jakob