Accidental vmdk deletion issue - assistance needed to recover

[breakaway9000]

Hi Guys

I'm running ESXi 6.0.0 build 9313334 on a Lenovo X3650 M5 server.

Last night I deleted a .VMDK (a 2nd disk from a Server 2012 R2 VM) that resides on an SSD volume by accident. This server had two disks - one was its boot volume (C: drive) and the other was just data (D : drive. I have deleted this "D" drive accidentally. And to further complicate things. This Server 2012 R2 box was a file server, and the D : drive which was deleted had data deuplication enabled.

And of course, there were no backups. The VMDK in question was approx 500 GB in size with about 450 GB used.

I have since then evacuated the datastore (moved the VM that had this disk attached to another datastore) to prevent any further writes to it, in order to enhance my chances of data recovery.

Is there anything I can try to get my VMDK back, or is that "It"?

If this was a Hyper-V server, the backing datastore would be NTFS, and I'd be running an accidental deletion recovery tool similar to GetDataBack for NTFS or PhotoRec. Is there something similar for VMFS volumes? The backing volume is actually a SSD (no RAID involved).

[scott28tt]

@continuum - your skills may be needed here if you have the capacity to help!

[breakaway9000]

After a lot of reading I decided to try "DiskInternals VMFS Recovery". The software runs on windows and connects over SSH to your ESX host in order to see if the files can be recovered.

Unfortunately, I have to report that the deleted file isn't visible after the recently deleted scans.

All VMs in this environment are thin provisioned - apparently this makes recovery difficult/impossible?

If there are any other steps I could try before I write this off - any help would still be appreciated.

[pwolf]

I am no data recovery specialist, but according to your description, your solution can only be to find a program/life DVD, that works on the bare disk without interference from any hypervisor and which can manipulate VMFS filesystems. And it will be a quite complicated provedure.

[breakaway9000]

I have the FusionIO  PCI-e ssd passed through to a brand new VM I created. I am now running DiskInternals "File Signature Scan". It says 11 hours to go. However  - I am not hopeful anything will turn up.

[continuum]

Hi

to recover a deleted vmdk a File Signature Scan is not what you need to run.
You need a scan that does the equivalent of Testdisk.

Ulli

[breakaway9000]

Hi @continuum - I will message you on skype.

Thanks!