Hello everyone,
I lost a somewhat important file from a software crash in an appvm.
Within the VM, I couldn't find a way to recover it. I copied the appvm
filesystem containers ('private.img', 'private-cow.img',
'private-cow.img.old').
As I understand it, 'private-cow.img' contains the old version of files
that were changed since last appvm startup.
However, '-cow.img' files contain no filesystem, but "binary patch"
data, thus can't be mounted or read directly or without their
corresponding'.img' files.
I found only little info online. Qubes documentation [1] says about
reverting template 'root-cow.img' changes:
> 1. Ensure that no other VMs uses this template.
> 2. Prepare snapshot device with root-cow.img.old instead of root-cow.img
> (/etc/xen/scripts/block-snapshot prepare).
> 3. Replace snapshot device-mapper target with snapshot-merge, other
> parameters (chunk size etc) remains untouched. Now kernel starts merging
> changes stored in root-cow.img.old into root.img. d-m device can be used
> normally (if needed).
> 4. Waits for merge completed: dmsetup status shows used snapshot blocks –
> it should be equal to metadata size when completed.
> 5. Replace snapshot-merge d-m target back to snapshot.
> 6. Cleanup snapshot device (if nobody uses it at the moment).
> 7. Move root-cow.img.old to root-cow.img (overriding existing file).
I tried to apply these steps to 'private.img' and 'private-cow.img', but
already failed with the second step, where I couldn't really figure out
how to use the '/etc/xen/scripts/block-snapshot' script.
Is there any hope to recover an older version of a changed/deleted file
from 'private-cow.img'?
Can anyone give me a pointer how to access its content, aka "apply its
content as a patch to 'private.ig'"?
Thank you in advance,
Stickstoff
[1] https://www.qubes-os.org/doc/template-implementation/
--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/8bbce168-ea9c-6ef9-b6b0-a39e037e1ba8%40posteo.de.
