DESPERATE: Recover virtual HDD deleted by "recreate" [tech support absent]

FOR THE LOVE OF GOD SOMEONE PLEASE HELP ME!!

[Prologue: PARALLELS TECH SUPPORT IS COMPLETELY ABSENT:
I paid $30 yesterday (1/24/2007) to call Parallels tech support: no one was available so I left a message at 3pm PST. Also emailed tech support. Haven't heard back on any front, and every time I call again there's still no one available.
Also, I had no clue this forum existed until I just now stumbled upon it through Google; unless I'm blind from grief it's not linked from the Parallels Support page or any other Parallels page.]


I have been using Parallels Desktop to run WindowsXP out of a virtual hard disk (.hdd file) on my MacBook. My primary task in windows is programming memory experiments in MatLab (I'm a grad student in cognitive psychology).

Yesterday I needed to install MS Office in WinXP, but the the virtual HDD didn't have enough room (about 7.5gb out of 8gb was full). I accidentally used the "recreate" method of expanding the virtual disk image size that apparently deletes your current disk image and replaces it with a new, empty one. I blame Parallels for poor design [warnings on the implications of "recreate" were not explicit enough] and myself for being an idiot.

I had maybe two weeks worth of programming work that only existed inside of Windows, and wasn't backed up. This was the only Achille's heel in my otherwise robust backup scheme.

I WAS ALMOST READY TO RUN MY EXPERIMENT AND DESPERATELY NEED THOSE MATLAB FILES BACK!

My 8gb .hdd file was replaced by a new 1.2mb one in under a second. This gives me reason to believe that the old HDD file may still exist in the uncharted corners of the hard drive.

The MacBook is 2.3ghz with 2gb RAM, 100gb HD (about 30gb free), running OS X 10.4.8. I'm running Parallels Desktop build #1970, and the Guest OS is Windows XP.
I've done almost nothing on the MacBook since realizing what happened, for fear of overwriting any traces of the lost data.
After never hearing back from Parallels tech support yesterday, I got the MacBook home (without it going to sleep) and booted it in target mode connected to my G5 by firewire. I've been running some data recovery programs like VirtualLab and FileSalvage from my G5, but of course the .hdd is not a recognized file format for these programs. I might have found some salvageable MatLab files using VirtualLab (perhaps it can see into the lost .hdd file?), but it will be expensive to register the software to actually recover them.

Finally, I also found sleepimage and swapfile0 - swapfile4 and got those off the MacBook. They're apparently saved RAM states from the last few times the MacBook went to sleep. I found out I can use the following line to extract text from these files:
sudo strings sleepimage | grep XXXXX
where the XXXXX is some string you want to search for.

By this method I can see that some of my MatLab code exists in these saved RAM states, but I don't know if I'll be able to get enough out for it to be useful, or even how to go about trying.

But come on, there's GOT to be a better/easier way! Even if I got my code back it would still be a huge ordeal to reinstall WinXP, configure it, reinstall MatLab, configure it, etc. Man, if I could recover the whole .HDD file, that would be like winning the lottery at this point.

PLEASE, does anyone have ANY suggestions or relevant information?
thanks very much,
~jason

 

I have no idea if this can help you - but you might want to get in touch with Steve Gibson. He is an information recovery expert, and seems to have some understanding of how virtualization software works. You can find his website at http://www.grc.com/default.htm. Send him an email. Your problem may intrigue him enough he will respond.

 

Try this: http://www.binarybiz.com/vlab/mac-download.php

It would be best to shut down the system and install the drive in another system as a second disk. The longer it runs in the current system the less likely you will find what you need.

 

Ouch man, I've been there...


The only possible way your old file could still exist is if you immeadiately (i.e. took out the battery and unplugged the machine) turned the computer off as soon as it was deleted, and have not turned the machine back on.

The OSX filesystem makes new files on 'unused' space. When you delete a file, all it does is mark it as 'unused'.

To get it back, take the drive out of your mac, and put it into a different computer that is running linux. Make sure to mount your drive read-only. You can use some of the low-level HFS+ tools to restore the file to a dfferent drive. It has been several years since I have had to do this, so I don't remember the name of the tool to use... maybe someone else can suggest that one.

Its a real pain in the butt... If it takes less then about 15 or 20 hours of work to re-create the programs it would be worth it...

For the future... I have discovered that CVS is my friend.


As for Parallels not helping you... Their tech support is pretty bad (ok, *REALLY* bad), but I don't think they could do anything in this case.

 

Ouch. I work providing IT support at a university and sadly these experiences are not unusual.

Now firstly, I would try to not to get too angry at how Parallels had identified the "Recreate" button as that will not get your data back. (Perhaps it needs a secondary warning window when you click on it, versus just the one warning written beside it -- but this is not really where we should focus now.) Secondly, I don't think that Parallels tech support will really be able to help you as this is really a data recovery question that is beyond any advice they could give with relation to their product.

So on to the issue. You are correct that this when you clicked on the 'recreate' button you instantly created a new disk image and your existing disk image was flagged as deleted. You are correct that likely (at least at the time that you did this) this old disk image was possibly left intact. There are a few problems here. One is that your disk image is a large file that takes up a reasonable percentage of your hard disk. So there is a reasonable chance that the computer could start overwriting on the portion of the disk that this disk image is on -- it could have even written part of the new disk image on it. This is not a good thing. A second problem is that this file format is a complicated one and if part of the disk image file gets overwritten it could be very difficult to get this disk image running well enough to get parallels to mount it. So if you do not get 100% back I am not sure if you will be able to do anything with the results. I doubt I could, but perhaps some professional recovery company could.

So the first thing you have to do is stop using this macbook and try some disk recovery software. At least one has been suggested. And as has already been suggested you should run this on an other hard disk. What I would do is get the software install it on another mac and boot your mac up as a hard disk. This is known as Target disk mode. You will need a firewire cable to join the macs together. How to do this is described here: http://docs.info.apple.com/article.html?artnum=58583

Have you checked within your own IT support on campus. Perhaps someone in the IT there has access to some disk recovery software. IT support for macs certainly varies from campus to campus but there may be some mac nerd on your campus that can help you out or recommend data recovery methods.

Having said, all of this, I am afraid I have to repeat something I said already, I would not be terribly hopeful to get this data back. The disk image is a huge file which increases its chance of being written on and I am not sure what one would do with a parallels disk image that had been corrupted by being partially overwritten on.

Sorry. My condolences, and good luck...

 

Thanks for the info and sympathy everyone.
The MacBook is now with the one IT guy in our department who knows anything about Macs. He didn't tell me what data recovery software he has, but he's going to try and recover of the MatLab files if they still exist. I gave him the example MatLab files I used to train VirtualLab on that file type. The nice thing is that these files show up as plain text and the first line is the function declaration, with the function's name right there so you can quickly tell what you're looking at.

They've got all the equipment to be able to yank the drive and run it as a secondary HD and all that too.

I don't have high hopes, but at least I snagged some lines of code from the RAM core dumps I salvaged (or whatever they were) and those can help remind me what all I had done if I have to rewrite it.

And at least all that's lost is stuff that I CAN do again, even though it will be a spirit-crushing pain in asthma. It's not like I lost irreplaceable photos or emails. And this isn't NEARLY as bad as losing actual collected scientific data (all of THAT is in the robust backup scheme).


ONE MORE QUESTION:
(for when I've eventually got Windows reinstalled from scratch)
Can anyone point me toward a (prefereably free) Windows application that would automatically copy files from one folder to another? My Parallels shared folder gets backed up thru Mac OSX, but I can't have that be my working directory for MatLab and thus I've had to manually copy the MatLab files into the Parallels shared folder. I need something to automate that process, like on a regular schedule or triggered by events like startup/shutdown. I know nothing of Windows software so don't even know where to begin looking. Thanks!

 

UniAce -- I don't know about Matlab -- if it saves its files in "My Documents," you can easily enough redirect that to a shared folder in parallels. I don't keep any actual data on my XP installation, only the programs. So, if I toast the VM (which I've done through pure negligence a couple of times), I can simply restore the VM from backup and I'm back where I left off, because all of the data resides in my OSX home folder.

Don't know if this applies to your situation. Good luck with the data loss -- it sucks, but unfortunately it does happen to all of us occasionally.

 

Here's a few: Use the Windows built-in scheduler and the built-in copy command. You can also share out the Windows folder so the Mac can see the files and write a simple cron job (got to luv Unix) to copy those files from the Windows partition to OS X file space. Install ssh in Windows, install MacFuse in OS X, and use sshfs to create a shared folder in Windows that OS X can use for copying the files. Install NFS from Microsoft (used to be free) and make an nfs mount between OS X and Windows, and create a script to copy the files. Open a file explorer window in Windows and drag the files to OS X on a regular basis. Write a batch file in Windows that zips the files from the Windows partition to the Mac folder. Install U/Win or MKS tool kit in Windows and use any of the excellent Posix tools to tar, zip, bzip, or dump your files to OS X file space. If the files are text, print them to a file in OS X file space.

I'm just getting started - there's lots more ways to do this. It's a simple problem.

 

Dkp, thanks for all the ideas. Milesce, I think I tried early on to have my working MatLab files reside in a shared folder, but either MatLab just refused to cooperate or it was really really slow.

Oh, Parallels tech support finally called me back tonight (over 24 hours later), but while I was at dinner and couldn't answer. They left a message saying they'd try again in 30 minutes, but they haven't called again since.

ANOTHER QUESTION
While I'm planning to start over: should I think about installing Windows on a new partition rather than using a virtual hard disk? I have to switch between OSX and WinXP too much to consider using Bootcamp ever, but still I wonder if a partition install for Parallels has advantages.

 

Gosh, what an awful experience. It's an experience I've had (long ago) that made be very careful.

Others have made some excellent suggestions for backup, so I'll just add a description of my technique.

I have a multi tier backup protocol that I cycle whenever I've done enough work that I don't want to lose it. I have a directory under my VM directory in OSX called backups. I also have several external drives. I keep a backup of my .hdd files in the backups directory, and a copy, using the Finder's file copy command which produces a file called "copy of x" where x is the original.

When it's time to back up, I move the "copy of" files from the VM directory to the backups directory, replacing the old ones. This is quick. Then I use the Finder to make copies of the .hdd files in the VM directory. This gives me two backups on the Mac hard drive.

Then once in a while (about once a week or when I've done enough on the Mac that I don't want to do it again, or when I'm about to do something I may not be able to undo) I backup the entire Mac to an external. I use a program called SuperDuper for this. It's free if you want to clone your Mac to an external drive, but since it copies all the files, it can take a while. It's a good task to let run while you sleep. If you buy the product, it unlocks an incremental mode which copies only files that have changed since the last backup (and deletes files that are no longer on the Mac). I use this with two alternating external drives, and I've never lost anything despite making regular mistakes, some of them really unthinking and stupid, but I'm really paranoid about the backups (which I'm sure you will be from now on as well since I got there by the same route you just did). One advantage of the external drive technique is that if you use a firewire external as I do, the copy is bootable, so if you trash the mac internal drive, just boot from the external, and use SuperDuper to put everything back.

After I make copies of my VM files, I sometimes run the Parallels compressor (and here let me emphasize AFTER MAKING COPIES) which keeps the size of the .hdd files more manageable.

I hope this is useful, and wish you luck in your experiments.

 

For your research files... look into Subversion

subversion.sourceforge.net

I'm a grad student in CS, and it is the defacto standard for saving files here. Not only will it save the files, it can save multiple versions of the same files (binary and text).

Not so good for system-level backups, but really good for research code/data.