How to Recover Virtual Machines and Snapshots in XCP-ng and XenServer
-
Author:
Vladimir Artiukh
-
Editor:
Oleg Afonin
In this article, we will explain how to recover data from virtual machines and snapshots in XCP-ng and XenServer, where virtual disks are stored, how the snapshot mechanism works, and what to do if a virtual machine has been deleted or its disk has become inaccessible. We will also cover options for recovering data from virtual disks after file system corruption, accidental file deletion, or storage failure, as well as the use of specialized software for information recovery.
- XCP-ng Local Storage Architecture
- Connecting Disks and Creating Images
- How to Recover XCP-ng / XenServer Virtual Machines and Snapshots
- Conclusion
- Frequently Asked Questions
- Comments
XCP-ng and XenServer hypervisors are used to create, run, and manage virtual machines that store operating systems, applications, and important data on virtual disks. To protect against failures and to enable rollback to a previous state, snapshots are used (snapshots). However, deletion of a virtual machine, storage corruption, hardware failure, administrative errors, or an unsuccessful snapshot merge can result in loss of access to important data.
To address these issues, we will use the cross-platform utility Hetman RAID Recovery. This program allows you to connect disks and perform recovery in Windows, Linux, and macOS environments. It automatically recognizes the logical structure of server storage devices, safely extracts intact virtual machines together with snapshots, and also allows you to find and recover deleted files directly from inside guest operating systems.
How to Recover XCP-ng / XenServer Virtual Machines and Snapshots
XCP-ng Local Storage Architecture
For successful data recovery, it is important to understand how a Storage Repository works in the XCP-ng environment. The hypervisor supports storage based on LVM, where each virtual disk is created as a separate logical volume. However, today we will focus on local storage with the EXT4 file system, where virtual disks are stored as regular files.
After a server failure, such a drive becomes an unrecognized device for standard desktop operating systems. Built-in Windows or macOS tools simply do not understand the specific logical structure deployed by the hypervisor. As a result, you cannot directly connect the disk and copy the required images, even if the data itself remains physically intact.
It is also worth mentioning the specifics of virtual disk and snapshot formats. In the XCP-ng environment on EXT4 storage, files are usually stored in VHD format. When a snapshot is created, the system generates a new linked differencing file, and all subsequent changes in the guest system are written to it. The hypervisor creates these snapshots to capture the exact state of a virtual machine at a specific point in time.
It is extremely difficult for a third-party system to interpret such a specific structure without dedicated software. This is where Hetman RAID Recovery comes in.
The program accurately recognizes the logic of the EXT4 file system and instantly provides direct access to existing virtual machine and snapshot files, as well as efficiently finds previously deleted data. In addition, the utility fully supports work with LVM-based storage, allowing you to successfully find and recover virtual disks directly from logical volumes. The program algorithm automatically recognizes their configuration, ensuring safe data extraction even in the event of serious damage to the host structure.
| Component | Description |
|---|---|
| Local Storage Repository (Local SR) | A local storage repository connected to the XCP-ng server where virtual machine disks (VDI) and related data are stored. |
| Storage Repository (SR) | A logical storage unit used by the hypervisor to organize access to virtual disks. An SR can be local or network-based. |
| Physical Block Device (PBD) | An object that associates an SR storage repository with a specific XCP-ng host and provides access to it. |
| Virtual Disk Image (VDI) | A virtual disk that stores the operating system, applications, and files of the guest operating system. |
| Virtual Block Device (VBD) | A virtual device that attaches a VDI to a virtual machine (VM). |
| VHD (Virtual Hard Disk) | A virtual disk format used in many XCP-ng and XenServer storage repositories. It can support chains of base disks and snapshots. |
| LVM (Logical Volume Manager) | A logical volume management mechanism used in certain types of local storage based on block devices. |
| EXT (ext4 file system) | A file system used to store virtual disk files in the corresponding type of local storage. |
| Snapshot | A saved state of a virtual machine or its disks at a specific point in time. Depending on the storage type, it may be implemented through a chain of virtual disks. |
| VHD chain | A sequence of a base disk and child disks containing snapshot-related changes. Breaking the links between them can make access to current data more difficult. |
| XAPI | The XCP-ng management API used to work with virtual machines, storage, virtual disks, and snapshots. |
| Storage metadata | Information about the SR configuration, virtual disks, and their relationships. Damage to or loss of metadata may cause virtual disks to stop appearing in the management interface. |
Connecting Disks and Creating Images
The first step in the recovery process is to physically remove the server drives and connect them to a workstation:
- The best option is direct connection to the motherboard SATA ports.
- If there are not enough free ports, or if you are using server SAS drives, you can install an HBA expansion card.
- As an alternative, you can use external USB enclosures or docking stations, but keep in mind that USB bandwidth may increase the total scan time.
There is one critically important rule when connecting drives. The Windows, Linux, or macOS operating system may prompt you to format or initialize new disks. These system prompts must be ignored and simply closed to avoid destroying the information permanently.
To ensure maximum safety of the original data, we always recommend creating a full image of the connected drive. This is an exact byte-for-byte copy of your physical disk. This built-in feature also helps in situations where you cannot connect all required drives to the computer at the same time.
To create an image, select the disk in the program, click Save disk, and specify the path to save the file.
After that, open the main menu, select Mount disk, choose the Raw disk images type, and open the saved image for further safe work.
How to Recover XCP-ng / XenServer Virtual Machines and Snapshots
METHOD 1. Recovering Existing and Deleted Virtual Machines
Let’s move on to the practical part. Immediately after selecting our drive, the program automatically recognizes the EXT4 file system structure. We start a Quick Scan of the connected storage.
Within seconds, the algorithm detects existing virtual disks together with snapshot file chains. The same quick search works equally well for the LVM architecture, where the program instantly finds all available logical volumes containing virtual machines.
First, let us consider the recovery scenario for existing virtual machines. In our case, the files are physically present on the disk, but access to them was lost solely due to a general server failure. We simply select these intact virtual machines, click the Recovery button, and successfully save them to a safe local drive on our computer.
Now let us consider the situation with files that were accidentally deleted by the user before the system failure.
Pay attention to how deleted files are displayed in the program interface. They are marked with a special red cross, which makes them easy to find.
Select these found deleted virtual machines, click the Recovery button, and successfully save them to a safe local drive on our computer.
METHOD 2. Recovering Files from Guest Operating Systems
Another powerful feature of the program is the ability to directly mount found virtual disks. This makes it possible to access their internal contents without the need to start the hypervisor itself.
Most importantly, we can even mount deleted virtual disks that the system has just found on our EXT4 storage and extract useful information from them.
After mounting the disk, we start a Quick Scan on it.
At this stage, we demonstrate the process of searching for user files that were accidentally deleted inside our Windows 10 guest operating system before the general server failure.
The program successfully reconstructs the directory tree. We can review the found data using the preview function, verify the integrity of the documents, and perform the final save of the required files to the local computer.
METHOD 3. Recovering Data Using Snapshots
The program also works well with system snapshots. After disk analysis, the interface displays snapshot files alongside virtual machine files. Here, you can see both existing current snapshots and those that were previously deleted.
First, let us demonstrate data recovery from an existing snapshot. In our case, we created one base system snapshot. We mount this found current snapshot, run a quick scan, and perform the process of searching for and recovering files that correspond exactly to this specific point in time.
Now let us move on to recovering data from a deleted snapshot. To make the test more challenging, after creating the first snapshot we added new files, created another snapshot, and then deleted it completely.
We mount this deleted snapshot found by the program, scan it successfully, and save the required files to the local computer.
This clearly confirms the system’s ability to recover data regardless of the current snapshot status.
Conclusion
Recovering virtual machines and snapshots in XCP-ng and XenServer depends on the cause of data loss, the type of storage, and the state of the virtual disks. Accidental deletion of a virtual machine, storage corruption, physical drive failure, or disruption of a snapshot chain can result in loss of access to the operating system, applications, and user files.
During recovery, it is important to correctly identify the storage structure (SR), locate the corresponding virtual disks (VDI), and verify the integrity of VHD files and the dependencies between them. If a disk or snapshot is inaccessible through the management interface, this does not always mean that the data is permanently lost. In some cases, information can be recovered directly from the virtual disk using specialized data recovery software.
To avoid making the situation worse, it is recommended to stop write operations on the damaged storage, not delete the remaining snapshot chain elements, and not create new storage on top of a device with lost data. If possible, create a sector-by-sector copy of the drive and perform further actions on the copy.
Specialized data recovery software, including Hetman Software solutions, can help scan accessible virtual disks, find lost files, and recover information after deletion or file system corruption. The result depends on the state of the storage device, the nature of the damage, and whether the lost data has been overwritten.
Regular backups, verification of snapshot integrity, and monitoring the condition of XCP-ng and XenServer storage will help reduce the risk of data loss and shorten the recovery time of the virtual infrastructure.
