VMFS Recover or Undelete

Version 6

    Protect a VMFS volume on ESX 3.5

    As you know, when you remove a VM or a vmdk disk from disk (and not only from inventory or VM) you loose all your data.

    Is possible to roll back? Yes... just restore from a backup.

     

    But if you do not have a VM backup? Or a recent one?

     

    The solution could be the VMDK Recovery Tool.

     

    It requires proactive steps to protect the VMFS datastore: only if the block-list (a plain text file that keeps a record of all VMDKs of the virtual machines) is generated automatically it will work in a production environment.

    Also if VMs are moved, cloned etc. or reconfigured it must be refreshed or the tool could do more damage than good.

     

    Some limitations of the VMDK Recovery Tool are that is an experimental software (means that the tool is not supported and might not work as expected in all customer environments), it works only in ESX 3.x (is not available for ESXi and for ESX 4.0 ) and you cannot restore from multiple block list files.

    Although ESX 4.0 use the same VMFS of ESX 3.5 (there is only a minor version difference), the vmfs-undelete script (written in python) seems that does not work on ESX 4.0.

     

    To configure this tools there is also an HowTo: Protecting ESX VMFS Stores with Automation

     

    -


    VMFS file recover

    What can I do if I delete the data and I never configure the VMDK Recovery Tool?

     

    In this case you can use some tools that make a search at physical block-level: for example http://www.ufsexplorer.com/

    UFS Explorer is designed to make no matter where your data reside. It supports fast and safe access to set of storages, including SCSI/SATA/PATA hard disks, USB mass storage devices, RAID arrays, VMWare, Microsoft Virtual PC, Parallels Workstation, Bochs virtual disks and RAW disk or partition image files.

    UFS Explorer did not find any file system or folder structure or file names so all the deteced file are RANDOM#.JPG or RANDOM#.TXT. The data that is stored inside files like for images EXIF and word files the Author are intact so I was able to indentify my data by a combination of looking at file sizes + adding additional fields to the display in windows.

    Note that the advanced data scan took about 1 hour per GB.

     

    -


    VMFS partition recover

    What can I do if I loose the VMFS partition?

     

    If you only loose the partition, is possible recreate with fdisk.

    See: Re: Removed VMFS3 volume from iSCSI target - am I screwed?

     

    -


    VMFS file copy

    How is possible recover the files if ESX does not work, but VMFS is fine?

    http://kb.vmware.com/kb/1014447 - Accessing virtual machines on an ESX4 host that will not boot

    Another solution could be use the open VMFS driver (http://code.google.com/p/vmfs/), but it seems to be quite slow.

     

    -


    For more details on VMFS there is the great Understanding VMFS Volumes