How to extract data from a corrupted virtual machine?

Question

linux

Hello comrades!
There is a Debian host system, qemu-kvm virtualization.
I will describe the problem.
There is an image of the virtual machine Windows 2008 r2 (raw 60GB). This image is corrupted. Apparently, the beginning of the "disk" is erased. testdisk does not find any partitions. fdisk -l w2k8r2.imgdoesn't show anything either.
But there is an early working backup of this file. Those. the same file, but six months ago. It, unfortunately, lacks the necessary data, but in theory it is possible to tear out the worn beginning from it. That's just how to do it?
Or what do you recommend?

Answer 1

To get started, make a copy and keep it as the apple of your eye.
Then try to copy the partition table from the backup to a copy of the disk. If it helps - merge the data and rejoice, if it doesn't help - go with the original to the recovery office. The main thing is not to lose or damage the original image

Answer 2

Under Linux? Copy XXX bytes of data from one file to another file?

dd conv=notrunc iflag=count_bytes if=old_backup.img of=w2k8r2.img count=2k

I don't really know if 2 kilobytes (the count=2k parameter) is enough to copy all information about NTFS partitions on the disk (that is, in the image).

Answer 3

can't figure out how to copy the partition table

mount the image then use sfdisk

Answer 4

Is it ProxMox? How is the disk of the windows2008 virtual machine packed with ZFS, LMV, quem?
Have you tried attaching the drive to another VM and checking it for errors?

Answer 5

"Beginning" is how much?
If a couple of sectors are 512 bytes each, then it's not particularly scary. If a couple of gigs, then there will be garbage.
You can try to run the image using R-STUDIO and hope that the program will find the pieces and the MFT and restore something from them.