Restore files delta.vmdk without flat and data loss (vmdk)

[serfeel]

Good morning, I have a serious problem,

Today I rejoined the company and I see that they have been working well, I do not want to go into details, the summary would be that a machine stopped due to lack of space and directly made connection by FTP and deleted mvdk, etc. It turns out that the important disk containing very sensitive data is like snapshot, "disk-delta.mdkv", although there is also the vmdk, but not the flat.vmdk. Is it possible to recover the data? It was a secondary disk, not OS.

Thank yo very much and sorry for my bad English.

[rcporto]

Hi Sergio,

The following VMware KB article shows how to recreate a missing virtual machine disk descriptor file : VMware Knowledge Base

[continuum]

Please do not try to create a new descriptor-file as suggested !

That is contraproductive and will eventually ruin all chances for a successful recovery.

I will explain what to do in a few minutes ....

[vXav]

If I understand correctly he has the descriptor file of the delta disk but missing the data file (flat).

In which case I believe the only solution is to restore the volume from backup.

An alternate solution might be to make the VM point at the base disk, meaning all the changes made to that disk since the snapshot was taken is lost (better than nothing I guess).

[rcporto]

Sorry, I misunderstood... I thought he have the flat vmdk and only the description vmdk was missing.

[continuum]

> An alternate solution might be to make the VM point at the base disk

Sounds like a solid plan - given the fact that the basedisk is missing.

@ Sergio

You have 2 options:

1. fake a new basedisk - attach the snapshot to it and hope that the snapshot is so large and old that parts of the data can be extracted.

This should be the last option - only useful if plan B fails

2. recover the lost flat.vmdk manually

To do that please read my instructions:

Create a VMFS-Header-dump using an ESXi-Host in production | VM-Sickbay ​

create a dump as described and provide a download link

With a little bit of luck I can then recover the original flat.vmdk

[serfeel]

Hi continuum thank you very much for your answer, can you give me directions, how to do what you tell me in the first step?

I searched and found this post Orphaned snapshot files - need to recover data back to base disk  where you also appear but I do not know exactly how to do it.

Thanks in advance

[continuum]

I need all your small vmdk-descriptorfiles.

Connect to your ESXi via WinSCP and download them and attach them to your next reply.

We need to know how the original basedisk was partitioned and formatted.

[serfeel]

I dont know if you need something more.....

[continuum]

Wow - so all the details you provided so far are dubious !

Did somebody renamed any of your vmdk-files ?

Did you followed that stupid Knowledgebase-article ?

I need all descriptor-vmdk-files with a size of  just a few hundred bytes.

I also need to know what exactly you did so far !!!

I need to see the output of

hexdump -C DOMINIO_1-000002-delta.vmdk | less

and

hexdump -C DOMINIO_1-000002-flat.vmdk | less

Use WinSCP to download the descriptor-vmdks.

And tell the guy who interacted with this VM this morning between 11:18 and 11:55 to leave us alone.

[serfeel]

Your answer scares me, I tell you about your questions

Did somebody renamed any of your vmdk-files ?

Yes, they tell me that they have modified vmdk, renamed, tried to recreate the flat. DOMAIN_1-000002-delta.vmdk has not been touched, DOMAIN_1-000002.vmdk, it was renamed to try to create the flat, but then it was renamed to its original name. DOMINIO_1-000002-flat.vmdk has been created with this article https://www.youtube.com/watch?v=9WH8Mujl-vs

Did you followed that stupid Knowledgebase-article ?

https://www.youtube.com/watch?v=9WH8Mujl-vs

I need all descriptor-vmdk-files with a size of  just a few hundred bytes.

I also need to know what exactly you did so far !!!

I need to see the output of

hexdump -C DOMINIO_1-000002-delta.vmdk | less

[root@localhost:/vmfs/volumes/5989e3b0-cccdfcc1-60b7-901b0ed03d90/DOMINIO] hexdu

mp DOMINIO_1-000002-delta.vmdk | less

0000000 4f43 4457 0001 0000 0003 0000 0000 bb80

0000010 0001 0000 0004 0000 b800 000b 0572 bcca

0000020 0000 0000 0000 0000 0000 0000 0000 0000

*

0000900 18eb 0000 0000 0000 0000 0000 0000 0000

0000910 0000 0000 0000 0000 0000 0000 0000 0000

*

00009a0 b794 0000 ac5e 0003 bc7e 0003 cca0 0003

00009b0 dcc0 0003 ece0 0003 fd00 0003 0d20 0004

00009c0 1d40 0004 2d60 0004 3d80 0004 4da0 0004

00009d0 5dc0 0004 6de0 0004 7e00 0004 8e20 0004

00009e0 9e40 0004 ae67 0004 be90 0004 ceb0 0004

00009f0 ded0 0004 eef0 0004 ff10 0004 0f30 0005

0000a00 1f50 0005 2f70 0005 3f90 0005 4fb0 0005

0000a10 5fd0 0005 6ff0 0005 7bd8 0005 8030 0005

0000a20 a050 0005 b070 0005 c090 0005 d0b0 0005

0000a30 12ab 0006 22cb 0006 32eb 0006 430b 0006

0000a40 532b 0006 634b 0006 736b 0006 0c6c 0006

0000a50 0ebc 0006 badb 0006 cafb 0006 db1b 0006

0000a60 eb3b 0006 fb5b 0006 0f75 0007 1f95 0007

0000a70 2fb5 0007 3fd5 0007 4ff5 0007 6015 0007

0000a80 7035 0007 fced 0006 d564 0007 c454 0007

0000a90 ce5c 0007 e344 0007 166c 0008 043c 0008

0000aa0 0c64 0008 03a7 0008 3f9d 0008 5b38 0008

0000ab0 4e74 0008 50a4 0008 7b48 0008 9245 0008

0000ac0 a744 0008 b808 0008 d70d 0008 b85f 0008

0000ad0 c17f 0008 e1c5 0008 01ea 0009 18aa 0009

0000ae0 28c4 0009 3c1b 0009 2c45 0009 3215 0009

0000af0 63a2 0009 7b75 0009 8b8e 0009 9ba1 0009

0000b00 abb5 0009 ba52 0009 c4c4 0009 d4db 0009

0000b10 e4f2 0009 fcb0 0009 0cc7 000a 1ee1 000a

0000b20 2efd 000a 3768 000a 3fe6 000a 5180 000a

0000b30 70a4 000a 80b1 000a 8be8 000a a169 000a

0000b40 b01b 000a b803 000a c2fb 000a c92b 000a

0000b50 d703 000a e6b3 000a fe25 000a 224c 000b

0000b60 327c 000b 3b3c 000b 5c90 000b 502c 000b

0000b70 5121 000b 4f34 000b 918b 000b a49f 000b

0000b80 aea2 000b bf12 000b b6ca 000b beea 000b

0000b90 f306 000b fb2e 000b a3e7 000b 2553 000c

0000ba0 356e 000c 458e 000c 460e 000c 563e 000c

0000bb0 75e4 000c 8384 000c 8bac 000c 93d4 000c

0000bc0 b59c 000c c634 000c d5b9 000c df11 000c

0000bd0 eb39 000c fcf9 000c 1558 000d 27cd 000d

0000be0 3516 000d 3d3e 000d 4d63 000d 654b 000d

0000bf0 7860 000d 8086 000d a2be 000d 88ae 000d

0000c00 98fe 000d 90d6 000d b3a7 000d 7978 000d

0000c10 fa3a 000d fd81 000d 0db1 000e 15d9 000e

0000c20 3619 000e 3bf9 000e 5aee 000e 685e 000e

0000c30 7b52 000e 8b6d 000e 9c91 000e a3e9 000e

0000c40 cbd9 000e 1478 000f b439 000e ac11 000e

0000c50 ce11 000e e824 000e 9ab9 000e 0068 000f

0000c60 3c9f 000f 4dab 000f 57bb 000f 4df7 000f

0000c70 7342 000f 8e9a 000f 9aa5 000f 99f5 000f

0000c80 bf6e 000f cf8e 000f dfac 000f efcc 000f

0000c90 0008 0010 2297 0010 02a8 0010 0740 0010

0000ca0 5970 0010 f94e 000f 4c37 0010 60a0 0010

0000cb0 3e3c 0010 8f97 0010 a0b0 0010 b547 0010

0000cc0 9dc3 0010 c56b 0010 e123 0010 e94b 0010

0000cd0 d8bf 0010 c593 0010 219f 0011 3a00 0011

:

and

hexdump -C DOMINIO_1-000002-flat.vmdk | less

In this case, dont show nothing

[root@localhost:/vmfs/volumes/5989e3b0-cccdfcc1-60b7-901b0ed03d90/DOMINIO] hexdump DOMINIO_1-000002-flat.vmdk | less

Use WinSCP to download the descriptor-vmdks.

With which command do I download or where are these located this descriptor-vmdks?

And tell the guy who interacted with this VM this morning between 11:18 and 11:55 to leave us alone.

The acces has been canceled for everyone.

[continuum]

I think we should better continue this with Teamviewer / Anydesk ....

Call me via skype - I will be available in about 2 hours from now.

If that is no option please run the 2 hexdump-commands again - exactly as I posted them.

Your first command did not have the -C

> With which command do I download or where are these located this descriptor-vmdks?

Descriptor-vmdks are those vmdk-files that do not have -flat or -delta in their name and usually are just a few hundred bytes in size.

Downloading them with WinSCP should be straightforward.

You do not have WinSCP ? - that is no acceptable answer here - install it.

DO NOT USE STANDARD DATASTOREBROWSER !!!

Ulli

[serfeel]

I think we should better continue this with Teamviewer / Anydesk ....

Call me via skype - I will be available in about 2 hours from now.

OK, it seems perfect

You do not have WinSCP ? - that is no acceptable answer here - install it.

I have no technical knowledge so advanced, I use filezilla, however I leave it installed

Thank you very much.

[continuum]

WinSCP is a tool similar to Filezilla with one major advantage: it has an embedded fileeditor which is the easiest AND SAFEST option to edit files stored on a VMFS-volume

[serfeel]

Thanks, I turn on laptop and I'll call you to see if I can connect with anydesk and you can help me

[continuum]

For anybody else reading this - DO not repeat the mistakes that were made here:

1. Never rename any vmdk-files !

2. Never create new files with the same name as the files you accidentaly deleted before

3. Do not read KB 1002511 !!!!

4. Do not read obscure blogs on "how to recover lost VMDK-files ..."

5. Last but not least: anything related to recovery is a ONE-MAN-JOB - trying to recover anything in a team is a very very bad idea

6. If you are unsure - document every single operation BEFORE you try anything !!!!

In this case a minor error - which was probably fixable - has been made worse by too many cooks.

Result: a skilled troubleshooter has unnecessary problems while trying to figure out what actually happened

In this case it looks like 1 TB of valuable data before the troubleshooting started was probably destroyed

Trying to find the original lost flat.vmdk now - but as mistake 2 was made chances are poor.

Ulli

[daphnissov]

You should turn this into a blog article, link to it in your signature, and point folks there.

[continuum]

Yep - looks like it is really necessary.

I tried to get the dangerous Knowledgebase article deleted a year ago but finding somebody at VMware who is even willing to listen to me is beyond my skills.

Today I looked into some youtube tutorial videos made by VMware and was shocked - scary stuff !!!

[vXav]

I understood that he was missing the delta disk but never mind. Looks like you've got this anyway.