How to Recover a deleted folder and .vmdk file

[ARSB]

Dear all,

I accidentally deleted the .vmdk file and its folder by removing the Inventory from the virtual machine. How can I recover the Folder and the .vmdk file?

I have also found Knowledge Base relating to recovery of .vmdk file. It does not, however, mentioned on recovery of missing Folder.

Assistance much needed. Thanks in advance.

Clement

[Gidrakos]

Do you mean you deleted the actual underlying files/folder for the VM? If you've done that, then the only way to retrieve the files would be if you had a backup of the datastore they were stored on.

[ARSB]

Unfortunately yes. I accidentally click "Remove From Disk" rather than "Remove From Inventory" on vSphere Client.

Anyway to recover?

[Gidrakos]

Unfortunately, "Remove From Disk" completely deletes the files. The only way to get them back would be if the storage space itself was backed up somewhere. vCenter does not keep a copy of those files.

[ARSB]

Thanks Gidrakos​ for your advise.

Feeling very very sad though. 😞 😞 😞

[Gidrakos]

I know the feeling from experience. Hopefully it wasn't anything too important, but now you'll know to be extra careful in the future and potentially look into a means to back it up - VMs are just files, so it's very easy to copy them elsewhere for safe keeping

[continuum]

Which VMFS version do you use ?

With VMFS 6 your chances are not that good.

With VMFS 5 you actually have a decent chance to recover your files.

The vmx file and the vmdk-descriptorfiles are actually quite easy to recover.

Create a VMFS header dump like I describe here

Create a VMFS-Header-dump using an ESXi-Host in production | VM-Sickbay

The flat vmdks are more tricky - it depends on the provisioning type you used.

Thin vmdks are almost never recoverable with VMFS 6.

Eager zeroed vmdks on the other hand can be recovered with some luck.

Send a dump and I can tell you more

Ulli

[continuum]

> Unfortunately, "Remove From Disk" completely deletes the files.

Thats not correct. The flat.vmdk will not be removed or overwritten by the delete operation.

Ot will only remove the info about where that flat.vmdk is actually located - you can still find it if it is written in one piece

Ulli

[Gidrakos]

Only provided they are running VMFS, which is unlikely given that they don't have any backups of the datastore on which they placed the VM. Even then, the chances of recovering the files are slim.

"Remove From Disk" (or rather) "Delete From Disk" as opposed to "Remove From Inventory" will delete the files because that's its intended purpose. I've just tested and verified it on both local and NFS storage and there's no trace of any files remaining.

[continuum]

The purpose of "delete from disk" is not to completely remove the file but to make the used space available again - and that is a big difference.

[ARSB]

Hi continuum​,

Thank you for your input and really excited into hearing possibility of recovering the file. However, I am not comfortable in resolving the issue myself. I can contact you (via PM preferred) and connect you through TeamViewer to resolving the issue? What would your charges be?

p.s. I can brief you further on how I lost the file in more detail.

[lgio]

Hello i need support

Are you help me?

[lgio]

Hello i need support

Are you help me?

continuum​

[continuum]

read my signature and call me on skype

Ulli

[ARSB]

Problem solved. Many thanks to continuum​ for all the help rendered. Without your assistance I might not have recovered the data so soon or at all.

[continuum]

You are welcome.

Regards Ulli

[tosaad]

Hi Ulli,

i'm having the same issue can you help me?

Thanks,

[continuum]

Hi

I can try ...

call me via skype "sanbarrow"

Ulli

[tosaad]

Hi Ulli,

I'm calling you now.

Thanks

[continuum · Accepted solution]

This was a tricky one !

All the VMFS metadata for the VM was gone.

I had to carve out the missing VMDK from the datastore.

The vmdk had  two partitions - a smaller one with 560gb used for C: of a Win2008 R2 and a larger one with about a TB of data used as 😧

The first 600 gb of the vmdk was found in one piece and so we could use that to rebuild the bootdisk.

The missing 😧 could then be populated with data from a few weeks old backup.