VMware Cloud Community
Ivanildo_GalvÃ_
Enthusiast
Enthusiast

It is possible to undo revert snapshot

Hello Gentlemen,

I have a life or death case in a company here in Brazil, they called me today for help.
The fact is that they reverted snapshots of a file server, the VM returned to the state of 2018 and all files were lost.
In my understanding, without a backup it is impossible to recover the virtual machine, go back to the state of today, I think that even VMware itself does not have technical support documentation to resolve this without the use of a backup.
But, I ask here if anyone has already managed to do this magic, that is, almost a miracle.

Any idea ?

Ivanildo Galvão
11 Replies
scott28tt
VMware Employee
VMware Employee

VMware Workstation or a different product?


-------------------------------------------------------------------------------------------------------------------------------------------------------------

Although I am a VMware employee I contribute to VMware Communities voluntarily (ie. not in any official capacity)
VMware Training & Certification blog
Reply
0 Kudos
a_p_
Leadership
Leadership

Unless already done, try to contact continuum​ as he's the only one on VMTN who may be able to help.

André

As a side note: A question will get more attention by creating a new discussion, than with a reply to an old one.

Reply
0 Kudos
Ivanildo_GalvÃ_
Enthusiast
Enthusiast

VMware vSphere 6
2-node cluster using HP FC storage

Ivanildo Galvão
Reply
0 Kudos
a_p_
Leadership
Leadership

Discussion branched from Workstation Pro to a new discussion in ESXi

a_p_
Leadership
Leadership

Just a quick question. Does the storage system have storage based snapshots enabled for the affected LUN?

André

Reply
0 Kudos
Ivanildo_GalvÃ_
Enthusiast
Enthusiast

It is information to be checked.
I know it's an IBM V5000, this storage supports FlashCopy

Ivanildo Galvão
Reply
0 Kudos
nachogonzalez
Commander
Commander

You can use the Go To Snapshot option

Reply
0 Kudos
continuum
Immortal
Immortal

In some rare cases a revert to action can be undone.

But not in this case  - I looked into it already.


________________________________________________
Do you need support with a VMFS recovery problem ? - send a message via skype "sanbarrow"
I do not support Workstation 16 at this time ...

Reply
0 Kudos
novis75
Enthusiast
Enthusiast

Hi continuum,

I'm very curious, could you be so kind as to give us some examples where we can recover data after going back on a Snapshot? Thinks

Reply
0 Kudos
continuum
Immortal
Immortal

Sure - but let me warn you - this is not trivial.

First of all analyse the vmware.logs : you must be able to answer the following question:

What is the name of the delta/sesparse vmdk that was active before the "revert to snapshot" function was lauched.
For an example lets say the file in use was "name-000003-delta.vmdk"
Next figure out which delta/sesparse was set active after the "revert to snapshot" function was lauched.

If the new file uses the same name as before then your chances are very poor.

If the new file uses a different name then you can go on.

Next figure out the size of "name-000003-delta.vmdk" immediatly before  the "revert to snapshot" function was lauched.
If you find no data - try your best guess.

Now - comes the tricky part: run an intensive search for deleted / lost objects.
How to do that is far outside the area that I can explain in a post ...
Anyway - such a scan can come up blank or it can come up with a list of objects.
Such an object can have one fragment or thousands or millions.

Go through the list and check the size of the objects.
If you find anything that comes close in size to the lost delta - check the first fragment of the object if it starts with the expected magic signature.

So if you are lucky you find an object that may be a valid delta or sesparse vmdk and it has the expected size.
Then create a dd script and extract that file, copy it to ESXi and try if you attach it to a copy of the VM.

Sorry - this is just a rough overview - in an "easy" case I typically need 2-3 hours to figure out if there is anything that I can recover at all.
This is supposed to be impossible / or hopeless - so you will not find a lot of useful information in the documentation.


In this case I gave up hope when I realised that there was no deleted / lost object that was anywhere near to the expected size.
To figure that out I connected remotely and used a Linux VM running on the target ESXi.


________________________________________________
Do you need support with a VMFS recovery problem ? - send a message via skype "sanbarrow"
I do not support Workstation 16 at this time ...

Reply
0 Kudos
novis75
Enthusiast
Enthusiast

Thank you for taking the time to explain the steps to us.

I understand better the difficulty of doing such work, which I did not think possible.

A big thank-you

Reply
0 Kudos