Retrieve Data from an offline Qubes 3.2 AppVM on a storage device

18 Jan 2019

Attach the qubes partion to your computer. In this example the partition is at /dev/xvdi however it may be at a subaddress on the device depending on how you mounted the storage device.

Once the device is available run:

udiskctl unlock -b /dev/xvdi

Enter your Qubes passphrase.

Mount /dev/qubes_dom0-root:

mount -o ro /dev/qubes_dom0-root /mnt

VMs are stored at /mnt/var/lib/qubes/

In this example we are going to access an AppVM called self

Mount the vm private.img

sudo mkdir /self sudo mount -o ro /mnt/var/lib/qubes/appvms/self/private.img /self

Read and copy files as needed from the /self directory

Comments !