I was using the Workstation like I usually do, nothing out of the order (6-7 tabs in TOR Browser, KeePassXC, Tox)
Suddenly it froze completely (Gateway was working normally), I let it run for couple of minutes in hopes that it will unfroze, but without success.
I did the “power off the machine” and after 30 seconds I tried to run it again, but after the initial screen (systemd, etc.) there’s only black screen and blinking “_” on the screen at that’s it.
This sounds a bit like disk corruption. Do you have a snapshot you can restore to?
We’ve had a few users report random partition table corruption. It’s not clear why this happens, but you may be able to fix it:
Take a snapshot now, so that if the repair fails or makes things worse, you can get back to where you are now.
Boot the VM from an ISO file (Kicksecure would be a good option for this as Whonix is based on Kicksecure). If you choose to use Kicksecure, boot in either LIVE Mode | SYSMAINT Session or LIVE Mode | UNRESTRICTED Session.
When the GUI appears, open a terminal, and run lsblk to identify your system disk. If the partition table is broken, you will most likely see no partitions on the disk at all.
Run sudo fdisk /dev/sdX (replacing X as appropriate). You should see a notification that partition table corruption was detected and the backup table is being used.
Type w and press Enter to save the automatic repair done by fdisk.
Run lsblk again. You should see partitions on your Whonix drive again.
Shut down the VM, remove the Kicksecure ISO file, and attempt to boot it again.
Not quite, though that would work too. I was suggesting inserting the Kicksecure ISO file into the existing VM. You can do this in VirtualBox by doing this (forgot how involved this process was, just now re-did it to test):
Click “Whonix-Workstation-Xfce”
Click Settings
Select the “Storage” item in the left sidebar
Click “Add Attachment” (small blue button with a green + on it, second from the right, underneath the device list)
Select “Optical Drive”
An “Optical Disk Selector” window will appear, click “Add”
Navigate to the Kicksecure ISO and double-click it
At the bottom of “Optical Disk Selector”, click “Choose”
Back in the settings window, click the “System” item in the left sidebar
Enable “Optical” in the Boot Device Order and move it to the top
Click OK
Boot the VM, it will start Kicksecure from the ISO
But what you suggested would also work, so either way is fine.
You’re supposed to use fdisk on /dev/sdX (in your instance, /dev/sda), not /dev/sda1. /dev/sda1 is the EFI system partition, and so fdisk has now nuked that partition as it warned would happen. This isn’t really a big deal since you probably weren’t using EFI to boot the VM anyway, and you should have a snapshot to restore to.
I’d restore the snapshot from earlier, then try the process again, but use fdisk on /dev/sda rather than /dev/sda1 this time.
If that fails, try pressing e during bootup to customize boot options, then move your cursor to the end of the linux line and add rd.debug to the line. Then press Ctrl+X to boot, and see if you can get a screenshot of any error messages that appear. Then boot into the Kicksecure ISO like you did before, run sudo blkid, and screenshot that. Then share both screenshots here. That will tell us if the system is looking for a disk that no longer exists. If that’s the case, it should be possible to fix.