Recover Snapshoted VMDK file

[lord_voldmort]

I have a very huge problem and I don’t know how to deal with it and there it is:

From a working VM I just have two files and the others are gone:

SPSDEV01.vmdk

SPSDEV01-000001.vmdk

And the problem is obvious: when I create a new VM and represent the first one as a hard disk, it does not contain my resent files

If represent the second one it say the parent file does not exist

So what should I do?

I’m really in a very bad situation.

Is there any way to combine or merge these files or extract files from them?

[ssbkang]

Hi,

I would suggest you to modify the .vmx file (virtual machine configuration file).

To do this, you will need to see how the .vmx file changes when you take a snapshot.

So, do the following:

• Create a virtual machine (not with the VMDK above, make a new one)
• Take a snapshot
• Observer what's been changed on the .vmx file
  • This could be done by downloading from the datastore or ssh into the ESXi server and use vi/cat/less...etc

In this way, you will be able to identify what is required in .vmx file to point your virtual machine to the snapshot VMDK.

Hope this helps,

Steven.

[a_p_]

Although I'm afraid you are out of luck without a backup, I'd like to ask you to post a list of files with sizes, and time stamps.

The first files you mentioned is most likely a descriptor file which points to a missing ...-flat.vmdk and the second file is a snapshot/data file for with the descriptor is missing. In addition to the file list, please attach the descriptor file to a reply post (use the advanced editor).

Do you know what happened, caused this issue? Did someone e.g. try to delete files from the datastore browser?

André

Message was edited by: Sorry, I was distracted when I wrote the reply. Please post a screenshot of the Datastore Browser Window showing the files with sizes and time stamps.

[admin]

Seems that you have a situation here where you might be missing a few snapshots or the snapshot chain might be corrupted. you can power on the VM if you Change the PID (parent ID) value of SPSDEV01-000001.vmdk to CID ( child ID )  value of SPSDEV01.vmdk, 

ie : The Child ID of the first vmdk becomes the Parent ID of the SPSDEV01-000001.vmdk. The following KB should be helpful in doing the same

VMware KB: Resolving the CID mismatch error: The parent virtual disk has been modified since the chi...

Then point the SPSDEV01-000001.vmdk to VM and power it ON.It should power on. and if you see that the data is missing then you might be missing

a few more snapshots, find them and correct the chain, ie match it with its correct parent.

cheers.!!

[lord_voldmort]

First of all I must give the exact details

My server was running but suddenly it was down

I logged on to the vCenter and saw the server has been grayed out and un-accessible

I browsed the hard disk and it seemed that the .vmx file was corrupted because although it was a .vmx file but the icon wasn’t the same as healthy vmx files

So I created another VM, moved the two files (SPSDEV01-000001.vmdk and SPSDEV01.vmdk) in the new folder and connected the SPSDEV01.vmdk file to the VM and …. That was what happened

So after that I read about it and it seems that the first mistake was creating an new VM because of the CID problem!

[a_p_]

The CID chain is used to ensure data integrity in snapshot chains. Depending on how long the newly created VM was powered on and the size of the snapshot, you may experience more or less data corruption/data loss after fixing the snapshot chain manually.

So please provide the requested information (size and time stamps for the .vmdk files) and for how long you had the newly created VM powered on. In addition to this please use e.g. WinSCP to download the .vmdk descriptor files from the datastore and attach them to a reply post.

André

[lord_voldmort]

OK

This is the whole Folder view (I've downloaded the entire content)

which ones are the descriptor file?

and the newly created VM is about 3 days old

[a_p_]

>>> which ones are the descriptor file?

The two small .vmdk files without flat and delta in their names.

>>> and the newly created VM is about 3 days old

According to the files in the datastore, the VM is still powered on!? This reduces the chance of a "healthy" recovery. However, with the size of the snapshot there's still a good chance.

Two more questions:

Which .vmdk file is currently the active one, i.e. the one that's shown in the VM's configuration (.vmx) file?

Do you have a datastore with sufficient free disk space for a clone of the virtual disk, i.e. at least 80GB (better 90GB or more)?

André

[lord_voldmort]

it's powered on!! how ?!

the files have been attaced to this post

>>> Which .vmdk file is currently the active one, i.e. the one that's shown in the VM's configuration (.vmx) file?

SPSDEV01.vmdk

but the thing is that there is no VM on the machine! this is just the folder on the devastator

after the VM was Grayed out, i removed it from the Inventory

>>> Do you have a datastore with sufficient free disk space for a clone of the virtual disk, i.e. at least 80GB (better 90GB or more)?

yes i have free space

[a_p_ · Accepted solution]

You said the "SPSDEV01.vmdk" shows up in the .vmx file, but in the attached file it's "SPSDEV01-000001.vmdk"!?

Anyway, here are the steps I'd recommend in order to create a new virtual disk, so that the current files won't get touched.

• power off the VM
• edit "SPSDEV01-000001.vmdk" and set the value of "parentCID" to the value of the base disk's (SPSDEV01.vmdk) "CID" to repair the snapshot chain
• create a new sub-directory in the VM's folder named e.g. "Clone"
• from the command line in the VM's folder, run:
  vmkfstools -i SPSDEV01-000001.vmdk Clone\SPSDEV01.vmdk
  to clone the virtual disk - including its snapshot - into a new virtual disk.

Create a new virtual machine and once done, move the cloned virtual disk into the new VMs folder, then open the VM's settings and replace the virtual disk with the cloned one.Now try to power on the new virtual machine.

Before you use the server in production, I'd recommend you run chkdsk for all drives to resolve possible issues with the file system.

André

[lord_voldmort]

Hey Man! That was great and it did the trick!

Great!!!

Really i don't want to bother you anymore but I've got some questions:

1 - what do think caused the problem in the first place?

2 - what did i do wrong?

3 - if this case happens again what should i do first and what should i don't do?

anyway! thanks again ! you saved me !

[a_p_]

1. Can't tell you what happened. Are you the only admin? Did anyone try to delete files using e.g. the datastore browser?
2. Can't tell you either without knowing the answer to question 1
3. Don't panic and either create a new discussion here in the VMTN Community or open an SR with VMware. Only try to fix things by yourself if you exactly know what to do!

Glad I could help.

André

[lord_voldmort]

Yes! i'm the only admin and thats the fishy part !

[a_p_]

In this case you can only check whether Ron logged in to the system without permission!? Maybe Harry can find out about this :smileylaugh:

André