I lost a somewhat important file from a software crash in an appvm.
Within the VM, I couldn't find a way to recover it. I copied the appvm
filesystem containers ('private.img', 'private-cow.img',
As I understand it, 'private-cow.img' contains the old version of files
that were changed since last appvm startup.
However, '-cow.img' files contain no filesystem, but "binary patch"
data, thus can't be mounted or read directly or without their
I found only little info online. Qubes documentation  says about
reverting template 'root-cow.img' changes:
1. Ensure that no other VMs uses this template.
2. Prepare snapshot device with root-cow.img.old instead of root-cow.img (/etc/xen/scripts/block-snapshot prepare).
3. Replace snapshot device-mapper target with snapshot-merge, other parameters (chunk size etc) remains untouched. Now kernel starts merging changes stored in root-cow.img.old into root.img. d-m device can be used normally (if needed).
4. Waits for merge completed: dmsetup status shows used snapshot blocks – it should be equal to metadata size when completed.
5. Replace snapshot-merge d-m target back to snapshot.
6. Cleanup snapshot device (if nobody uses it at the moment).
7. Move root-cow.img.old to root-cow.img (overriding existing file).
I tried to apply these steps to 'private.img' and 'private-cow.img', but
already failed with the second step, where I couldn't really figure out
how to use the '/etc/xen/scripts/block-snapshot' script.
Is there any hope to recover an older version of a changed/deleted file
Can anyone give me a pointer how to access its content, aka "apply its
content as a patch to 'private.ig'"?
Thank you in advance,