Recover VM from erased drives

[t.desmet]

Hi, this is just a dive into the deep but we are looking for a way to recover the data that was on a KVM VM that was on erased drives with HP Drive Reset and running another OS on that node. We are currently running CentOS 7 on that node that was used for Proxmox. I do remember the ID of the VM (103). The reset was just done a few days ago so not much data except the new OS and some packages etc have been written to it. Any ideas on how to recover the files from the VM. On actually only need the F: drive of the VM (it was a Windows Datacenter 2019 installation) F: drive is just an additional drive made within the VM. The actually assigned virtual drive was just one with 100GB.

Proxmox info:
Version: 3.9
local-lvm storage was used for VM
VM id: 103
VM os: Windows Server Datacenter 2019
VM drives: 1
Like to recover: F: drive within Windows VM

Current:
CentOS 7.9
Erased drives
New drive setup

Thanks in advance.

 

[aaron]

I don't believe that is possible, is the drive has been properly erased.

You could try to recover the partition tables. For example with TestDisk.TestDisk. Should that actually work, you can see if the logical volumes still exist.

The VM disks are LVs in the `data` thin pool.

 

[username123]

if I was you I'd first make a backup of the disk using dd or clonezilla or something like that. then id try what Aaron was suggesting, but on the backup, so you don't damage your data any further. if you can't restore anything - which is sadly a pretty high chance depending on the settings you used in the formatting utility - you could still try and send of your original disk to some commercial data restore service, they have better tools than those that are freely available most of the time. but even they can't fix a drive that was formatted with multiple passes of writing random data.

 

[aaron]

Good point about making a copy first!

And regarding professional data recovery companies; I remember an interview a few years ago where someone in the business stated, that modern disk have their data tracks so close together, that once overwritten, the chances to get the data back is almost zero. I don't have a ink at hand though :-/

 

[t.desmet]

Thanks for the answers, so I tried using the software scalpel and it found the disk /dev/sda3 it scanned the entire 8TB but Scalpel cannot recover .img files so it would be useless for recovering the VM. I also tried TestDisk but that one only discovers the current logical volume.

 

[Ramalama]

I had success with a data recovery company once. They restored that time all the pictures and almost everything.

I tryed to do that before myself with testdisk and many more tools, but failed.

Was a recovery company in germany, I don't even remember their name, but the result was really good!

And that was with a 2,5" hdd, like 5-6 years ago. I don't even remember the companys name xD

 

[Ramalama]

I think that was ontrack, but need to check the bills.
I only remember that it costed around 300€.

Cheers