Restore data from QCow2 missing backing file (data recovery part 4)

30 Nov 2020

I have successfully restored data from my QCow2 file with a missing backing file. I wrote lots of C code to be able to convert the QCow2 file into an IMG file. Then I found a software to recover my file from a broken ext4 partition.

  1. Failed at backup…
  2. QCow2 file format
  3. Read QCow2 file using C

WARNING! This is not a replacement for a real backup, and it can only recover files existing in the QCow2 image and not files that are only in the backing file.

Convert QCow2 to IMG

Using my own software to read qcow2 file and write it as an IMG file

./read_qcow2 broken.qcow2 dump.img

Download recovery software

I stumbled upon a software called testdisk, for recovering files and broken partitions/filesystems. It can be found here

And finally recover some files

First we need to make the IMG file available to the Linux system as if it was a real drive under /dev. This can be done using losetup

losetup /dev/loop0 ~/dump.img

Now we have a /dev/loop0 device under /dev.

but before we start the recovery, make sure you have lots of available disk space. My QCow2 disk (and IMG file) was 50Gb but the restored data I got was ~300Gb before I had to stop it due to full disk. I belive the software will be able to find fragments of old deleted files and restore them too, thats why there is a lot more data than it should be.

Now we can run the recovery software.

cd ~/Downloads
tar xf testdisk-7.2-WIP.linux26-x86_64.tar.bz2
cd testdisk-7.2-WIP/
sudo ./testdisk_static

Replace ~/Downloads with the folder where you downloaded the recovery software.

First I started the software without logging
Selected my /dev/loop0 device
I know it is an EFI GPT partition map so I chose that one, if you don’t know you can choose None or if it is an standard MBR choose Intel.
Just start Analyze
Some warnings about invalid GPT partition information, this is expected as the partition table is most likely in the missing backing file for the QCow2 file. Just hit Quick Search to continue
And it found one partition, choose P to list files
Browse around using up/down arrows and enter. Use : to select the files/folders you want to restore. Then press shift + c to copy selected files.
Once again use up/down arrows and enter to browse to a location where the software can write the files to. Then just hit C again
Time to bring some popcorn and watch the show.. on Netflix or something because this will take some time. I did get most of my files back.

You can find the source code for my read_qcow2 project over at Github: