Restore without the Proxmox Backup Server

[charlesg]

I am trying to help someone who was abandoned by a provider. We have some of the VMs and the Proxmox installed (8.2.4 single node) but some VMs were destroyed. Unfortunatly, my knowledge of PX is pretty limited. My understanding so far:

Native backups would look like: `vzdump-qemu-{id}-{datestamp}.vma.zst`. Those were deleted with the `qm destroy`.

We found where, I believe, the Proxmox Backup Server was saving backups. It has folders named after missing instance IDs and a list of zip files: `2025-06-27T03_08_36Z-20250703T144411Z-1-001.zip`. Each zip has 4 blobs and the larger drive-scsi0.img.fidx.

Is there a command on the Proxmox server that I could use to read the zip or its content and restore VMs without access to the PBS?

The system has the `proxmox-backup-client`, but I'm not sure that's what I need.

 

[news]

Zip is not used by proxmox. You can take unzip and check the file.

 

[Chris]

We found where, I believe, the Proxmox Backup Server was saving backups. It has folders named after missing instance IDs and a list of zip files: `2025-06-27T03_08_36Z-20250703T144411Z-1-001.zip`. Each zip has 4 blobs and the larger drive-scsi0.img.fidx.

This might indicate that someone has tempered with the system! I would therefore advice to perform any further actions in an isolated environment to not propagate potentially malicious code.

You can then verify the integrity of the chunk store via find /<path-to-your-datastore>/.chunks -type f -exec proxmox-backup-debug inspect chunk {} \;

Is there a command on the Proxmox server that I could use to read the zip or its content and restore VMs without access to the PBS?

There is proxmox-backup-debug recover index <file> <chunks>, which allows you to restore without a running PBS instance by providing the index file (e.g. drive-scsi0.img.fidx) and the path to the chunk folder /<path-to-your-datastore>/.chunks. There are also flags to ignore missing and corrupt chunks as well as an output path. Please see man proxmox-backup-debug for more details.

 

[charlesg]

Zip is not used by proxmox. You can take unzip and check the file.

I've deducted the backups were done using a PBS but I don't have access to it. I'm assuming whoever was managing this was using their own PBS instance. The files we hope to recover were stored in a dDrive of the client. So I'm assuming a script or something else was moving the there. Each zip does have content that looks to be PBS related:

% ls -l 2025-06-27T03_08_36Z/
total 552
-rw-r--r--@ 1 user  staff     969 Jun 26 23:10 client.log.blob
-rw-r--r--@ 1 user  staff  266240 Jun 26 23:10 drive-scsi0.img.fidx
-rw-r--r--@ 1 user  staff      52 Jun 26 23:08 fw.conf.blob
-rw-r--r--@ 1 user  staff     542 Jun 26 23:13 index.json.blob
-rw-r--r--@ 1 user  staff     424 Jun 26 23:08 qemu-server.conf.blob

I'm hope I can do something with this content.

I had read about `proxmox-backup-debug` which is not currently on the PVE. I guess I would need to the command on there and try a `proxmox-backup-debug restore` after creating an empty disk to restore in.

 

[charlesg]

This might indicate that someone has tempered with the system! I would therefore advice to perform any further actions in an isolated environment to not propagate potentially malicious code.

You can then verify the integrity of the chunk store via find /<path-to-your-datastore>/.chunks -type f -exec proxmox-backup-debug inspect chunk {} \;


There is proxmox-backup-debug recover index <file> <chunks>, which allows you to restore without a running PBS instance by providing the index file (e.g. drive-scsi0.img.fidx) and the path to the chunk folder /<path-to-your-datastore>/.chunks. There are also flags to ignore missing and corrupt chunks as well as an output path. Please see man proxmox-backup-debug for more details.

Thanks Chris. The `proxmox-backup-debug` seems to be part of the Backup Server deployment. Is there a way to install the command on a Proxmox VE node?

If I was to deploy a new PBS, would it make it easier to read these files and restore from the new PBS?

 

[Chris]

Is there a way to install the command on a Proxmox VE node?

Yes, but only if you install the PBS server package. But I'm not sure what your goal is with that. As stated, I would not operate on these files in a production environment.

If I was to deploy a new PBS, would it make it easier to read these files and restore from the new PBS?

That depends, it is not really clear in what state your PBS instance is in. There is of course the option to re-install the PBS services and re-import a per-existing datastore. But that assumes your datastore contents are intake and consistent, which does not seem the case from what you showed so far.

E.g.

2025-06-27T03_08_36Z

this is not a snapshot folder date format used by PBS. So as stated before, it seems someone has tampered with the datastore contents.

 

[readyspace]

To verify if this is a valid PBS snapshot archive, check what's inside the ZIP:


unzip-l 2025-06-27T03_08_36Z-20250703T144411Z-z-1-001.zip

If it contains files like:

• index.json
• drive-scsi0.img.fidx
• drive-scsi0.img.blob
• qemu-server.conf

Then it is likely a repackaged PBS snapshot folder