furkangkhsn
Contributor
Contributor

Recover deleted VMDK files

Some vmdk files was deleted a couple of hours ago. Can i recover that data back?

Tags (2)
0 Kudos
6 Replies
continuum
Immortal
Immortal

A couple of hours ago ? - good - the faster you react - the better.
Please read
https://communities.vmware.com/t5/VMware-vSphere-Documents/Create-a-VMFS-Header-dump-using-an-ESXi-H...
and provide a dump like explained there.
Please include mbr.bin or gpt.bin and tell me what to look for.

Ulli


________________________________________________
Do you need support with a VMFS recovery problem ? - send a message via skype "sanbarrow"
I do not support Workstation 16 at this time ...

0 Kudos
continuum
Immortal
Immortal

Here is a short summary of the events that followed this post ....
Furkan send 2 dump-files as he did not remember on which datastore the vmdks were stored.
A short while later I found 2 vmdk-descriptorfiles using strings ....

# Disk DescriptorFile
version=1
encoding="UTF-8"
CID=ec12a068
parentCID=ffffffff
createType="vmfs"
# Extent description
RW 104857600 VMFS "centrallog-flat.vmdk"
# The Disk Data Base
#DDB
ddb.adapterType = "lsilogic"
ddb.geometry.cylinders = "6527"
ddb.geometry.heads = "255"
ddb.geometry.sectors = "63"
ddb.longContentID = "0f37222cfc26388475e79d34ec12a068"
ddb.toolsInstallType = "4"
ddb.toolsVersion = "10346"
ddb.uuid = "60 00 C2 96 d7 4e e5 c7-18 1a fc 3e 43 cd da 81"
ddb.virtualHWVersion = "14"

and

# Disk DescriptorFile
version=1
encoding="UTF-8"
CID=c46c6e3b
parentCID=ffffffff
createType="vmfs"
# Extent description
RW 104857600 VMFS "centrallog_1-flat.vmdk"
# The Disk Data Base
#DDB
ddb.adapterType = "lsilogic"
ddb.geometry.cylinders = "6527"
ddb.geometry.heads = "255"
ddb.geometry.sectors = "63"
ddb.longContentID = "368de53e9a0c7f9f50d46799c46c6e3b"
ddb.uuid = "60 00 C2 97 bb 01 e7 1e-ab 41 6b cc 12 61 5b b4"
ddb.virtualHWVersion = "14"

Both vmdks have a size of 50 GB.

Then a while later I found 2 deleted 50gb objects in the VMFS metadata.
From both locations I extracted 1 MB to check the partitiontables ....

Number Start (sector) End (sector) Size Code Name
1 2048 104857566 50.0 GiB 8E00

and

Number Start (sector) End (sector) Size Code Name
1 2048 4095 1024.0 KiB EF02
2 4096 2101247 1024.0 MiB 8300
3 2101248 104855551 49.0 GiB 8300

Furkan apparently was lucky and his vmdks were thick provisioned and occured in 1 piece.

So I was able to create a dd-commands to extract them.

Ulli


________________________________________________
Do you need support with a VMFS recovery problem ? - send a message via skype "sanbarrow"
I do not support Workstation 16 at this time ...

0 Kudos
continuum
Immortal
Immortal

dd-comands to check the partitiontable:

dd if=/dev/disks/naa.600508b1001c42cb968ef634179de1bc:1 bs=1M count=1 skip=2199569 of=50gb-start.bin
dd if=/dev/disks/naa.600508b1001c42cb968ef634179de1bc:1 bs=1M count=1 skip=540689 of=50gb-start-2.bin

Commands to extract the complete 50gbs
dd if=/dev/disks/naa.600508b1001c42cb968ef634179de1bc:1 bs=1M count=51200 skip=2199569 of=50gb-flat.vmdk
dd if=/dev/disks/naa.600508b1001c42cb968ef634179de1bc:1 bs=1M count=51200 skip=540689 of=50gb-2-flat.vmdk




________________________________________________
Do you need support with a VMFS recovery problem ? - send a message via skype "sanbarrow"
I do not support Workstation 16 at this time ...

0 Kudos
continuum
Immortal
Immortal

News ....
the 2 vmdks I detected before belong to another VM - one that came without its own directory ...
This means the original dump with size of 2000Mb was too small.
Now we try with 3096MB

 


________________________________________________
Do you need support with a VMFS recovery problem ? - send a message via skype "sanbarrow"
I do not support Workstation 16 at this time ...

0 Kudos
Rohits1208
Contributor
Contributor

If you want to recover corrupt or damaged VMDK files which are damaged due to VMware tools crash, power failure, hard disk crash, virus attack, and more. You can try Cigati VMDK Recovery Tool one of the most prominent utilities to repair corrupt VMDK files on any version of virtual machine VMware.

0 Kudos
continuum
Immortal
Immortal

Can a moderator please remove this shameless advertising link ?
This tool is not worth mentioning

Ulli

 


________________________________________________
Do you need support with a VMFS recovery problem ? - send a message via skype "sanbarrow"
I do not support Workstation 16 at this time ...

0 Kudos