[Podman] Re: HELP! recover files from a deleted container

On Sep 4, 2023, at 2:32 PM, Robin Lee Powell <rlpowell(a)digitalkingdom.org&gt; wrote: If you have the image, and you know what the data you're looking for looks like (i.e. it's text you can search for), try just loading the image in a hex editor and searching for it. On Mon, Sep 04, 2023 at 09:05:37AM -0400, Alvin Thompson wrote: > Hi and thanks for the suggestions, > > Since this is Podman for Windows which uses a WSL instance, I’m hopeful that not starting Podman or messing within the WSL instance will preserve the data if necessary. WSL stores the EXT4 filesystem in a vhdx image which hopefully is isolated from Windows enough. If I’m wrong about this please let me know. > > This is a work computer with rather strict controls so what I can do with it is limited. I did make a copy of the WSL disk image so that’s something. Unfortunately, I may have already overwritten the data because in a panic the first thing I did was try to copy any folder I could find with the name “container”. I was hoping the files would be unlinked and cleaned up later if space were needed. Perhaps that’s a feature suggestion. > > I’ll see if I can grab another Intel computer, install VirtualBox on it, attach a copy of the image, and boot a recovery DVD with that. > > Thanks, > Alvin > > >> On Sep 4, 2023, at 8:15 AM, Tobias Wendorff <tobias.wendorff(a)tu-dortmund.de&gt; wrote: >> >> 1. Immediately stop using the system: Cease all activities and avoid any further operations on the affected system. This minimizes the risk of overwriting the data you want to recover. >> >> 2. Turn it off as soon as possible. Maybe unplug the power supply to turn it off immeditely. >> >> 3. Don't boot from the disk again. Remove it if necessaray. >> >> 4. Boot into a data-recovery DVD or put it on another system and mount it read-only. >> >> The more you do on the hard drive, the more likely it is that the data will be overwritten. The data is then virtually unrecoverable. Normally, however, you can recover deleted data. They were not intentionally overwritten (shredded). >> >> >> Am 04.09.2023 um 12:26 schrieb Alvin Thompson: >>> Help! >>> Is there any way to recover files from a deleted container? Long story short, I found the behavior of `podman network rm -f` unexpected, and it wound up deleting most of my containers. One in particular had a month of work in it (I was using it as a development environment), and it turns out only part of it was backed up. I’m desperate! >>> This is Podman for Windows, so most of the files on the “host” are in the WSL environment. I can get into that no problem with `wsl -d podman-machine-default`. >>> As an added wrinkle, my default connection was `podman-machine-default-root`, but I was was not running Podman rootful. I’m not sure this is particularly relevant. >>> grep-ing for strings which are unique to the development environment shows one hit in Windows, in %HOME%/.local/containers/podman/machine/wsl/wsldist/podman-machine-default/ext4.vhdx - which I assume is the file system for the WSL layer itself. I made a copy of it. >>> A grep within WSL itself doesn’t show so any hits, so it’s possible the files were deleted as far as WSL is concerned. I tried searching for an EXT4 undelete tool, but the only one I found (extundelete) is from 10+ years ago and doesn’t appear to work anymore. >>> I haven’t stopped WSL (I’m using /tmp as a staging area) or restarted the computer. >>> I’m at wit’s end. I really don’t know where to begin or look to recover these files, which I really, really need. Any recovery suggestions (no matter how tedious) would be welcome. >>> I know it’s too late to change now, but man, the behavior of `podman network remove` is unexpected. >>> Thanks, >>> Alvin >>> _______________________________________________ >>> Podman mailing list -- podman(a)lists.podman.io >>> To unsubscribe send an email to podman-leave(a)lists.podman.io > _______________________________________________ > Podman mailing list -- podman(a)lists.podman.io > To unsubscribe send an email to podman-leave(a)lists.podman.io