VMDK recovery from Delta file

[lf128]

Long story short - a folder was deleted from the datastore which contained the flat and descriptor file for one drive on a server containing very important data. This was also the time when we found out the backups were corrupt. We have the *000001-ctk.vmdk, *000001-delta.vmdk, and 000001.vmdk file for this drive. Is it possible to recover the main descriptor and flat file (or the entire deleted directory) from this?

Any help is greatly appreciated

[a_p_]

Welcome to the Community,

snapshot files only contain changed blocks, so you cannot recover the base (flat) disk from it. However, the larger the snapshot is, the better are chances to recover at least some data from it.

What you may do is:

• create a new virtual disk on the server (exact same size as the deleted one, thin provisioned to save disk space)
• check whether the block count in the newly created virtual disk's descriptor .vmdk file matches the one in the snapshot .vmdk file's descriptor!
• format the newly created virtual disk the same way as the deleted one
• remove the new virtual disk from the server (do NOT delete from disk)
• chain the snapshot .vmdk file with the newly created .vmdk file (see steps below)
• -> backup the current xxx-000001.vmdk
• -> set parentCID in xxx-000001.vmdk to the newly created virtual disk's CID
• -> set parentFileNameHint to the newly created virtual disk's descriptor .vmdk name (in case it's not in the same folder, you'll have to specify the absolute path)
• create a clone (requires additional disk space, but avoids modifications to the existing snapshot file)
• -> vmkfstools -i xxx-000001.vmdk -d thin clone.vmdk

Now you may attach the clone.vmdk to a system, and see what can be recovered, either natively, or by using file recovery tools.

If you have questions, feel free to ask.

André

[continuum]

Which ESXi version do you use ?
Which VMFS version do you use ?
When did you discover that the flat.vmdk was deleted ?
Was the flat.vmdk thick provisioned ?
How much free space in % did you have on that datastore before the flat.vmdk was deleted - no need to be precise - just to give me an idea.
Depending on your answers it may be still possible to recover the flat.vmdk
If you decide to try to recover the flat original then DO NOT CREATE ANY NEW FILES on the affected datastore.
Ulli

[a_p_]

Sorry, I didn't think of a possible file recovery.

That's indeed something that might be considered in first place.

André

[continuum]

Andre
the times when recovering a deleted vmdk was a straight forward task seem to be almost gone.
More and more users seem to believe that using thin provisioned vmdks is a good idea in small environments.
Generally speaking recovery of deleted vmdks is way less probable with ESXi 6 and later than it used to be.
Ulli

[lf128]

The folder that is missing is on ESXi 4.1. The main server files are on a different datastore and that is why the other drives are still showing up for that server. The folder contained a 700GB thick provisioned drive. We were in the beginning stages of migrating this server to a new host. We had about 100GB free on that server before we lost the folder, now we have 799GB. The loss was discovered very late on Aug. 11th. The other servers on the host were all powered down at that time to prevent overwrites. Any help is greatly appreciated.

Mike

[continuum]

Recovery has been started.
VMFS metadata for the lost flat.vmdk is unusable so we started to search for the MBR of the windows disk using scalpel.
Results expected in 12 hours

[continuum]

VMDK has been located now.