Deleted VM files


Yesterday I got a message from my collegue. 2 Of our Virtual machines on a vmware ESX 4 server, were not running anymore.

When we tried to reboot the machines. We got a nice error:  VMX file not found. After a little research we discovered that almost ALL the files are deleted.

When I watch in the directory i see:

-rw------- 1 root root  145M Dec 22 17:48 Redmine Server-000001-delta.vmdk
-rw------- 1 root root 1009M Dec 22 17:50 Redmine Server-000002-delta.vmdk
-rw------- 1 root root  5.2G  Jan  5 03:30 Redmine Server-000003-delta.vmdk
-rw------- 1 root root  593M Jan 11 11:42 Redmine Server-000004-delta.vmdk
-rw------- 1 root root   10G   Dec 22 17:47 Redmine Server-flat.vmdk
-rw-r--r-- 1 root root     0       Jan 11 11:42 Redmine Server.vmsd

So there are many files missing. But it seems that the data is still there.

Is there ANY way that I can mount these Delta files? I hope someone can help me :smileyplain:

Tags (3)
0 Kudos
7 Replies
VMware Employee
VMware Employee

OK, it looks like someone has been trying to delete files from the datastore, as only the files that are locked are still present.

You can recreate the .vmdk descriptor files by hand, but its not an easy task and especially becasue you have 4 snapshots.

You definitely must have a look at Ulli Hankeln's site

He's the vmdk expert.

The problem is that since you don't have the .vmdk descriptor files, you don't know your snapshots CID chain. Was 000002-delta linked to 000001-delta or linked to the base disk (-flat). The same is applicable to the other delta files. If you are sure that there hasn't been a "Revert to Snapshot" operation since Dec 22, 17:47 you can link all deltas to eachother in the order 4-3-2-1-flat (based on the last modified date).

If you are not sure, the only safe way is to link delta-000001 to the flat file, but you'll loose all changes since Dec 22, 17:50



Arnim van Lieshout Blogging: Twitter: If you find this information useful, please award points for "correct" or "helpful".
0 Kudos

Thank you for the usefull comments. Smiley Happy

I know that every snapshot is linked to the previous one: 4-3-2-1-flat.

I'm now busy following this blog:

Lets hope that this will work Smiley Happy

0 Kudos

Welcome to the Community,

if you haven't done this before please be very careful!

If you like to have help, please create a new dummy VM (e.g. named "X-Redmine Server") with a 10G virtual disk (same format and virtual disk controller as the original one) and create 4 snapshots on it. Then attach the 5 header vmdk files (not the flat and/or delta vmdk files) as well as the vmsd file to your next post. I will then modify the files accordingly. After you copy the new files to the old datastore, we should create a clone of the current virtual disk (including the snapshots) to make sure the current files are not going to be modified. Then create a new VM and attach that cloned virtual disk to see whether everything is ok.


0 Kudos


Really thank you guys for the advice :smileylaugh:

What I have done:

- I made a new VM almost identicaly to the original one.

- I took 4 snapshots of the machine.

- Replaced all 4 000X-delta.vdmk files with the ones of the original machine.

- Fortanaly I didn't thin located my VM.

- I manual made a new VMDK Delta and header file with the command:

vmkfstools -c 10737418240 -a lsilogic tmp.vmdk

10737418240 is (in bits) the size of my Virtual HD. This is the size of my original FLAT.vmdk file.

This create a VMDK file (useless, delete it) and a VMDK header file (which you want)

-edit tmp.vmdk (=the header file) and copy the following code:

ddb.virtualHWVersion = "7"
ddb.longContentID = "9841b78aa0068846dfb7aa30fffffffe"
ddb.uuid = "60 00 C2 9b 98 13 b6 9f-1a 9f b4 79 e0 7b f6 db"
ddb.geometry.cylinders = "1305"
ddb.geometry.heads = "255"
ddb.geometry.sectors = "63"
ddb.adapterType = "lsilogic"

And pasted in MY VMDK file. Overwrite the standard lines.

- Change de RW value to '20971520' in every vmdk header file. This value comes from the tmp.vmdk.

- Edit the CID and PARENTID of every vmdk header file. So the hang toghetter as a chain.

Run the machine and profit :smileygrin:

More info about creating a VMDK file:

Thank you  really :smileygrin:

0 Kudos
Hot Shot
Hot Shot

Glad it works:)

Best Regards, Hussain Al Sayed Consider awarding points for "correct" or "helpful".
0 Kudos
VMware Employee
VMware Employee

Glad to hear everything has worked out well.

Now find out who tried to delete your VMs and let him pay your next dinner Smiley Wink

Sent from my iPad

Arnim van Lieshout Blogging: Twitter: If you find this information useful, please award points for "correct" or "helpful".
0 Kudos