How to Recover Data from a Corrupted QCOW2 Image After Failed Resize Operation in KVM/Libvirt


4 views

After attempting to resize a QCOW2 disk image with qemu-img resize, you're now staring at a corrupted disk that neither KVM nor diagnostic tools can properly handle. The system reports conflicting messages - qemu-img check claims no errors, yet the image refuses to mount or convert.

The error message L2 table offset 0x2d623039326500 unaligned suggests critical metadata corruption in the QCOW2 header. This typically occurs when:

  • The resize operation was interrupted
  • Storage medium had I/O errors during operation
  • Filesystem wasn't properly synced before resize

1. Create Emergency Backups

Before attempting any recovery, make multiple copies:

cp diskimage.qcow2 diskimage_backup1.qcow2
cp diskimage.qcow2 diskimage_backup2.qcow2

2. Advanced Repair Attempt

Try forcing metadata reconstruction:

qemu-img amend -f qcow2 -o compat=1.1 diskimage.qcow2
qemu-img check -r leaks diskimage.qcow2

3. NBD Alternative Without Kernel Module

If you can't load nbd module, use userspace NBD:

qemu-nbd -c /dev/nbd0 -f qcow2 diskimage.qcow2
mkdir /mnt/recovery
mount /dev/nbd0p1 /mnt/recovery  # Adjust partition number

4. Low-Level Data Extraction

For critical data recovery, use ddrescue:

apt install gddrescue  # Debian/Ubuntu
ddrescue -d -v diskimage.qcow2 diskimage_recovered.qcow2 recovery.log

For severe corruption cases, try specialized tools:

# Install qcow2 recovery toolkit
git clone https://gitlab.com/qemu-project/qcow2-tools.git
cd qcow2-tools
make

# Attempt cluster-by-cluster recovery
./qcow2-check -r all diskimage.qcow2

For future resizing operations:

  1. Always snapshot before resizing: virsh snapshot-create-as vm pre-resize
  2. Use atomic operations: qemu-img resize -f qcow2 --shrink diskimage.qcow2 +22G
  3. Verify filesystem integrity first: virt-rescue -a diskimage.qcow2

If all else fails, consider professional tools:

  • R-Studio (www.r-studio.com)
  • UFS Explorer (www.ufsexplorer.com)
  • Runtime Software's DiskExplorer

We've all been there - you need to expand a VM's disk space, run qemu-img resize, and suddenly the image becomes corrupted. The specific error message about unaligned L2 tables indicates structural damage to the qcow2 metadata.

Before attempting complex repairs, try these basic diagnostic commands:

# Check image metadata
qemu-img info broken_image.qcow2

# Run extended check with repair attempt
qemu-img check -r all broken_image.qcow2

If these show "no errors" but the image still won't mount, we need deeper intervention.

Method 1: Forced Raw Conversion

Sometimes converting to raw format can bypass qcow2 corruption:

qemu-img convert -f qcow2 -O raw broken_image.qcow2 recovered.raw \
    -p -n -S 0 -m 16

Key parameters:

  • -n: Skip target image creation (useful if source is damaged)
  • -S 0: Disable sparse conversion (better for corrupted images)
  • -m 16: Use multiple threads for faster processing

Method 2: QCOW2 Debugging Tools

The qemu project includes hidden gems for forensic analysis:

# Dump qcow2 metadata structure
qemu-img map broken_image.qcow2 | less

# Try mounting with explicit cache settings
sudo modprobe nbd max_part=8
qemu-nbd --connect=/dev/nbd0 --cache=writeback --aio=native broken_image.qcow2

For severely damaged images, try extracting data directly:

# Install forensic tools
sudo apt install sleuthkit

# Create offset map
mmls broken_image.qcow2

# Extract filesystem at specific offset
fls -o 2048 broken_image.qcow2
icat -o 2048 broken_image.qcow2 1-128-5 > recovered_file.txt

Best practices for safe resizing:

  • Always snapshot before resizing: qemu-img snapshot -c presize_snap broken_image.qcow2
  • Use atomic operations: qemu-img resize -f qcow2 --shrink broken_image.qcow2 +22G
  • Verify after resize: qemu-img check broken_image.qcow2

When standard tools fail, consider:

  • libguestfs: guestfish -a broken_image.qcow2 -i
  • Photorec: For raw file recovery from converted images
  • TestDisk: Partition table reconstruction