Rebuilding VirtualBox with missing VDI snapshots

VirtualBox is great, until you realise your missing the a key snapshot, or your original image and you only have the lastest snapshot on your backups. A while back I had the task of rebuilding a windows server for someone with only a recent snapshot. So I hope this offers you some technical support if you find this in a position.

The tools with virtualbox block you from loading or cloning the snapshots out of order, to block you from creating a courpt VirtualBox image.

The way virtualbox works is it records the write actions in your VDI file, until a snapshot is done. Then all writes are recorded to the snapshot, not the original VDI image. If you need to merge all the snapshots into a VDI file you can use the clone tool. Like this :

<code>VBoxManage clonehd originalfile.vdi newfile.vdi</code>

This works well if you have all the snapshots, but if you are missing the original vdi or snapshots it doesn’t work and complains about missing files.

Each snapshot stores its parent and child snapshot vdi files in its header. This information is also stored in the XML .vbox parameters file also. So if you have 2 snapshot and an original VDI you will have a directory structure like this :

<code>
./MyVM.vdi
./MyVM/Snapshots/{cbba3c66-5fea-44e0-9868-f02b2c2e5da4}.vdi
./MyVM/Snapshots/{9055c3b4-f4a6-4d99-855e-60660bcfe627}.vdi
</code>

Each VDI file will have a UUID key in it for its parent and child. MyVM.VDI will have cbba3c66-5fea-44e0-9868-f02b2c2e5da4 as its child. cbba3c66-5fea-44e0-9868-f02b2c2e5da4 will have MyVM.vdi UUID as its parent, and 9055c3b4-f4a6-4d99-855e-60660bcfe627 as its child.

To see the parent and child of a VDI file, you can use vboxmanage showhdinfo command.

<code>vboxmanage showhdinfo MyVM.vdi
vboxmanage showhdinfo {cbba3c66-5fea-44e0-9868-f02b2c2e5da4}.vdi
</code>

When you want to merge the VDI, it will seek out each UUID file listed and make sure it is there so it can replay all the snapshots in the correct order to create a new VDI image. If you are missing a key snapshot file, you can manually edit the headers in the VDI files to match the parent/child relationship you want. You’ll need to be reasonably confident around a hex editor and converting the UUID into HEX. But it is possible to force the clonehd command to work without failing about a missing snapshot.

Once you have edited a VDI files, you can use vboxmanage showhdinfo to inspect them to make sure they have the right parent/child relationship. Once the child/parent relationship has been resolved (it goes both ways, so both parent and child need to be updated), you can use clonehd to create a new VDI image and it will be none the wiserbut that a key VDI file is missing and will proceed with the rebuild.

You can also use a snapshot without the original VDI file to create a working new VDI by using clonehd over an empty filesystem set up in the right structure and formatted the same.

If the VDI file you are missing is a while back, it is possible to recover with minimal data loss. Though your operating system is unlikely to be bootable, as only files recently updated would be on the recovered VDI image. But it is workable enough that you mount the file system using a rescue CD and then copy of most of files of the effected system.

Hope this helps. And don’t forget to always back up your VM, ideally both internally in the OS and externally.