QCOW2 image recovery
QCOW2 can store data in an overlay while unchanged clusters remain in one or more backing images. Corruption, a missing parent, an incorrect rebase, or partial host-storage failure can make a VM unbootable or expose an incomplete point in time.
Understand the symptom
qemu-img can inspect a backing chain and check supported image formats. Its repair modes modify the image, and QEMU warns that broad repair can choose an incorrect fix or hide existing corruption. A valid QCOW2 header does not prove that its parent path, cluster map, guest filesystem, or newest data layer is complete.
What you may see
The overlay references a parent path or format that is unavailable or changed.
QCOW2 metadata contains invalid, leaked, or inconsistent clusters.
The overlay may be bypassed, detached, or linked to the wrong parent.
The QCOW2 layer or underlying host storage cannot return required clusters reliably.
Protect the source
qemu-img -r can change the source and may hide damage that needs forensic comparison.
An incorrect backing image can silently supply unrelated sectors.
Merging an overlay changes another chain member and reduces rollback options.
Do this now
Do not boot, snapshot, commit, rebase, repair, or convert the affected image.
Preserve overlays, backing images, libvirt or VM configuration, snapshots, logs, and original paths.
Capture format, virtual size, actual size, backing filename, chain order, and error messages without repair flags.
Image unstable disks or storage pools before running full-image checks.
NEPFOSYS process
NEPFOSYS maps image metadata, parents, snapshots, timestamps, and guest-storage objectives.
Every available image and the underlying host storage are acquired before modification.
Candidate chains are tested on copies and guest filesystems or priority data are extracted separately.
A clear next step
Start a case with the exact symptoms, incident timeline, prior attempts, encryption details, and the files that matter most. NEPFOSYS will route the case to the appropriate DFW intake or nationwide mail-in path.
Start with a case reviewQuestions, answered
A check without repair flags is intended to inspect consistency, but the image and host storage should still be protected first. Repair modes modify supported formats.
Name alone is insufficient. The parent must contain the exact expected sector state and format for that overlay.
The newest guest data may be distributed across overlays and their parents. Removing one layer can make later sectors unavailable.
DFW local · Nationwide mail-in