Corrupted virtual machine

[Cthulhu318]

Hi,

somehow my vm is corrupted, I tried rebuilding the VMX file, didn't work. The VMDK is not recognized when I create a new virtual machine.

Is there some way I can repair the VM?

Regards,

Erik

[scott28tt]

From the VM bundle, post a listing of the .vmdk files plus use the Attach function in the bottom-right of the post editor to upload a copy of the .vmx file and most recent vmware.log file.

[Cthulhu318]

drwxr-xr-x  7 epo30180  staff         224 22 jun 14:33 appListCache

drwxr-xr-x  8 epo30180  staff         256  1 jul 14:37 Applications

-rw-------  1 epo30180  staff        3874  7 jul 14:39 Windows 10 x64 KPN Werkplek.vmxf

drwxr-xr-x  3 epo30180  staff          96  7 jul 14:39 caches

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-000002-s007.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-000002-s008.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-000002-s009.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-000002-s010.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-000002-s011.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-000002-s012.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-000002-s013.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-000002-s014.vmdk

-rw-------  1 epo30180  staff  2164400128  7 jul 15:27 Windows 10 x64 KPN Werkplek-Snapshot1.vmem

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-s005.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-s006.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-s007.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-s008.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-s009.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-s010.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-s011.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-s012.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-s013.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-s014.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:27 Virtual Disk-s015.vmdk

-rw-------  1 epo30180  staff  3783065600  7 jul 15:29 Virtual Disk-s001.vmdk

-rw-------  1 epo30180  staff  4255055872  7 jul 15:29 Virtual Disk-s002.vmdk

-rw-------  1 epo30180  staff  4241752064  7 jul 15:29 Virtual Disk-s003.vmdk

-rw-------  1 epo30180  staff  1308229632  7 jul 15:29 Virtual Disk-s004.vmdk

-rw-------  1 epo30180  staff      196608  7 jul 15:29 Virtual Disk-s016.vmdk

-rw-------  1 epo30180  staff  2164400128  7 jul 15:29 Windows 10 x64 KPN Werkplek-Snapshot2.vmem

-rw-------  1 epo30180  staff      524288  7 jul 15:29 Virtual Disk-000001-s005.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:29 Virtual Disk-000001-s006.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:29 Virtual Disk-000001-s007.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:29 Virtual Disk-000001-s008.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:29 Virtual Disk-000001-s009.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:29 Virtual Disk-000001-s010.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:29 Virtual Disk-000001-s011.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:29 Virtual Disk-000001-s012.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:29 Virtual Disk-000001-s013.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:29 Virtual Disk-000001-s014.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 15:29 Virtual Disk-000001-s015.vmdk

-rw-------  1 epo30180  staff       65536  7 jul 15:29 Virtual Disk-000001-s016.vmdk

-rw-------  1 epo30180  staff   987168768  7 jul 15:29 Virtual Disk-000001-s001.vmdk

-rw-------  1 epo30180  staff   525402112  7 jul 15:29 Virtual Disk-000001-s002.vmdk

-rw-------  1 epo30180  staff  2230321152  7 jul 15:29 Virtual Disk-000001-s003.vmdk

-rw-------  1 epo30180  staff  2058616832  7 jul 15:29 Virtual Disk-000001-s004.vmdk

-rw-------  1 epo30180  staff        1897  7 jul 15:29 Virtual Disk-000001.vmdk

-rw-------  1 epo30180  staff        1913  7 jul 15:29 Virtual Disk.vmdk

-rw-------  1 epo30180  staff     5218304  7 jul 15:29 Windows 10 x64 KPN Werkplek-Snapshot1.vmsn

-rw-------  1 epo30180  staff    11563008  7 jul 15:29 Windows 10 x64 KPN Werkplek-Snapshot2.vmsn

-rw-------  1 epo30180  staff        1911  7 jul 15:31 Virtual Disk-000002.vmdk

-rw-------  1 epo30180  staff   901570560  7 jul 16:48 Windows 10 x64 KPN Werkplek-Snapshot3.vmem

-rw-------  1 epo30180  staff     6897664  7 jul 16:48 Windows 10 x64 KPN Werkplek-Snapshot3.vmsn

-rw-------  1 epo30180  staff  3918004224  7 jul 16:48 Virtual Disk-000002-s001.vmdk

-rw-------  1 epo30180  staff  4261937152  7 jul 16:48 Virtual Disk-000002-s002.vmdk

-rw-------  1 epo30180  staff  4261937152  7 jul 16:48 Virtual Disk-000002-s003.vmdk

-rw-------  1 epo30180  staff  4222746624  7 jul 16:48 Virtual Disk-000002-s004.vmdk

-rw-------  1 epo30180  staff  3274244096  7 jul 16:48 Virtual Disk-000002-s005.vmdk

-rw-------  1 epo30180  staff   123600896  7 jul 16:48 Virtual Disk-000002-s006.vmdk

-rw-------  1 epo30180  staff    57606144  7 jul 16:48 Virtual Disk-000002-s015.vmdk

-rw-------  1 epo30180  staff   502398976  7 jul 16:48 Virtual Disk-000002-s016.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 16:48 Virtual Disk-000003-s010.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 16:48 Virtual Disk-000003-s011.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 16:48 Virtual Disk-000003-s012.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 16:48 Virtual Disk-000003-s013.vmdk

-rw-------  1 epo30180  staff      524288  7 jul 16:48 Virtual Disk-000003-s014.vmdk

-rw-r--r--  1 epo30180  staff           0  9 jul 11:34 quicklook-cache.png

-rw-------  1 epo30180  staff      720896 13 jul 09:34 Virtual Disk-000003-s015.vmdk

-rw-------  1 epo30180  staff      393216 13 jul 09:34 Virtual Disk-000003-s016.vmdk

-rw-------  1 epo30180  staff        2013 20 jul 07:32 Virtual Disk-000003.vmdk

-rw-------  1 epo30180  staff    24576000 20 jul 07:46 Virtual Disk-000003-s002.vmdk

-rw-------  1 epo30180  staff  4260954112 20 jul 07:48 Virtual Disk-000003-s006.vmdk

-rw-------  1 epo30180  staff   862519296 20 jul 07:48 Virtual Disk-000003-s001.vmdk

-rw-------  1 epo30180  staff  1553858560 20 jul 07:48 Virtual Disk-000003-s003.vmdk

-rw-------  1 epo30180  staff  1860501504 20 jul 07:48 Virtual Disk-000003-s004.vmdk

-rw-------  1 epo30180  staff  3482714112 20 jul 07:48 Virtual Disk-000003-s005.vmdk

-rw-------  1 epo30180  staff  3851616256 20 jul 07:48 Virtual Disk-000003-s007.vmdk

-rw-------  1 epo30180  staff  4258332672 20 jul 07:48 Virtual Disk-000003-s008.vmdk

-rw-------  1 epo30180  staff  1651638272 20 jul 07:48 Virtual Disk-000003-s009.vmdk

-rw-------  1 epo30180  staff  1311588352 20 jul 07:48 Windows 10 x64 KPN Werkplek-Snapshot4.vmem

-rw-------  1 epo30180  staff     6680576 20 jul 07:48 Windows 10 x64 KPN Werkplek-Snapshot4.vmsn

-rw-------  1 epo30180  staff      524288 20 jul 07:49 Virtual Disk-000004-s010.vmdk

-rw-------  1 epo30180  staff      524288 20 jul 07:49 Virtual Disk-000004-s011.vmdk

-rw-------  1 epo30180  staff      524288 20 jul 07:49 Virtual Disk-000004-s012.vmdk

-rw-------  1 epo30180  staff      524288 20 jul 07:49 Virtual Disk-000004-s013.vmdk

-rw-------  1 epo30180  staff      524288 20 jul 07:49 Virtual Disk-000004-s014.vmdk

-rw-r--r--  1 epo30180  staff        2459 20 jul 07:49 Windows 10 x64 KPN Werkplek.vmsd

-rw-r--r--  1 epo30180  staff      755001 21 jul 10:44 vmware-2.log

-rw-r--r--  1 epo30180  staff      310812 21 jul 10:46 vmware-1.log

-rw-r--r--  1 epo30180  staff     1338008 23 jul 11:37 vmware-0.log

-rw-------  1 epo30180  staff        2015 23 jul 11:47 Virtual Disk-000004.vmdk

-rw-r--r--  1 epo30180  staff        1313 23 jul 16:30 Windows 10 x64 KPN Werkplek.plist

-rw-------  1 epo30180  staff      720896 23 jul 16:57 Virtual Disk-000004-s015.vmdk

-rw-------  1 epo30180  staff      327680 23 jul 16:57 Virtual Disk-000004-s016.vmdk

-rw-------  1 epo30180  staff     2408448 23 jul 16:57 Windows 10 x64 KPN Werkplek.nvram

-rw-------  1 epo30180  staff   695664640 23 jul 16:57 Virtual Disk-000004-s001.vmdk

-rw-------  1 epo30180  staff    74055680 23 jul 16:57 Virtual Disk-000004-s002.vmdk

-rw-------  1 epo30180  staff   337903616 23 jul 16:57 Virtual Disk-000004-s003.vmdk

-rw-------  1 epo30180  staff   726007808 23 jul 16:57 Virtual Disk-000004-s004.vmdk

-rw-------  1 epo30180  staff   723255296 23 jul 16:57 Virtual Disk-000004-s005.vmdk

-rw-------  1 epo30180  staff  2260074496 23 jul 16:57 Virtual Disk-000004-s006.vmdk

-rw-------  1 epo30180  staff  3022061568 23 jul 16:57 Virtual Disk-000004-s007.vmdk

-rw-------  1 epo30180  staff  2058158080 23 jul 16:57 Virtual Disk-000004-s008.vmdk

-rw-------  1 epo30180  staff  2023030784 23 jul 16:57 Virtual Disk-000004-s009.vmdk

-rw-r--r--@ 1 epo30180  staff      586493 23 jul 16:57 vmware.log

-rw-r--r--  1 epo30180  staff      715287 23 jul 16:57 startMenu.plist

[scott28tt]

Plus upload the VMX file and most recent LOG file using the Attach function (in the bottom-right of the post creator)

[Cthulhu318]

VMX file has disappeared. I think that is the problem. The VMware log file has no configuration data in the CONFIGURATION section.

[Cthulhu318]

vmware.log is attached, as mentioned, there is no vmx file anymore. CONFIGURATION section is corrupt.

[a_p_]

Interesting. That's something I've never seen before. Does one of the other vmware-?.log files contain configuration data?

If yes please attach it to your next reply.

The log file also shows an issues with one of the .vmdk files. Please extract the metadata from that file, and attach that to your reply too.

dd if="Virtual Disk-000004-s001.vmdk" of=metadata.bin bs=524288 count=1

André

[Cthulhu318]

The other VMware log files also say; " not printed". where data should be.

Metadata.bin attached.

[a_p_]

The good news is that the .vmdk file does not seem to have errors anymore, so VMware Fusion seems to have fixed that internally.

Regarding the configuration file: There may be a way to retrieve the .vmx file's contents from the latest .vmsn file (Windows 10 x64 KPN Werkplek-Snapshot4.vmsn). That's basically a binary file, which does not only contain metadata, so I don't want to ask you to attach it here on a public forum.

The way I'm thinking of, is to search the file for encoding = "UTF-8", which is usually a .vmx file's first entry. Then copy this, along with the following configuration entries, and create a new .vmx file by pasting the copied content into it. As a final - and very important - step, edit the .vmx file, an make sure that the virtual disk entry points to the latest .vmdk (snapshot) file, which - according to the vmware.log file that you've provided before - is "Virtual Disk-000004.vmdk".

André

[a_p_]

... unless already done, please consider backing up the VM's files in the current state!

André

[Cthulhu318]

Files are backed up, twice

using strings utility only returns jibberish, how do I search correctly ?

[wila]

Hi,

PMJI, you should be able to use volatility for this purpose.

See:

VMware Snapshot File · volatilityfoundation/volatility Wiki · GitHub

(look at the bottom of that page, it has the vmx content)

Hope this helps,

--

Wil

[Cthulhu318]

Hmm, with volatility I seem to bee unable to extract a profile, I suspect due to the VM being encrypted.

when using vmwaerinfo :

ERROR   : volatility.debug    : Memory Image could not be identified as ['VMWareAddressSpace', 'VMWareMetaAddressSpace']

[wila]

Hi,

Yes, if your VM was encrypted then the vmsn file should also not have the .vmx in the clear.

I suppose that now also answers why the configuration was not in the vmware.log.

Once a vm is encrypted - using the VMware encrypt VM feature - the vmx is no longer readable without decrypting it.

I'm not surprised that the vmsn then only displays jibberish (it should).

Starts to smell like a lost cause, hopefully André still has some ideas.

Perhaps there might be a possibility of decrypting it, but that would take time, at least the full vmsn (and of course the password)

--

Wil

[Cthulhu318]

Well, the password and the full file are there

time is an issue as always.

[a_p_]

Sorry, but I'm afraid that I can't help you with this, since the encryption keys are stored in the .vmx file. Don't you have a backup of this file somewhere? Did you check the lost&found folder yet?

The only one here on VMTN who may be able to help in such a case is continuum​.

André

[wila]

Hi,

I'm researching this atm and I might be able to help. Give me another 30 minutes to see if I can pull this off with one of my own VMs.

It won't be free though (will have to charge a few hours of my time)

If that's OK send me a PM.

--

Wil

[wila]

Failed.

Sadly I have to retract my offer as you need it fast and I don't have more time to research this now and I will have to write more code to get it to decrypt correctly.

--

Wil

[Cthulhu318 · Accepted solution]

Hi Wila,

I've opted for another solution, decrypting the VM however interesting, isn't a relevant option to me.

Thx all for your effort, this was an interesting ride of which I learned a lot. Will backup more frequently in the future

[wila]

Well at least you have a solution.

Yes on the backups.

As soon as I get a chance I will have another look at the decrypting part, not that it will matter for you anymore.

It has my interest, but it takes a bit of time to get it all to work properly and time for yet another project is the one thing I don't have atm.

--

Wil