VMware Communities
mi_sat
Contributor
Contributor

How to Recover Lost Data Occurring During Revert Snapshot

I performed a 'Revert to Snapshot' and ended up losing my data (excel files, etc.) created since the last Snapshot was taken. I thought reverting to snapshot would be like the Windows XP equivalent of System Restore, where only settings are reverted back to a prior state.

Is there any way to recover my data?

Tags (2)
Reply
0 Kudos
13 Replies
rcardona2k
Immortal
Immortal

I'm scratching my head a bit...in that you still have System Restore in the guest OS, so if that's what you wanted...why revert the snapshot instead of using System Restore? The warning on revert to snapshot is dire: By restoring this snapshot, you will lose all changes made to the virtual machine since the snapshot was taken. This may include newly installed programs and data. This action cannot be undone. Do you want to restore this virtual machine to its exact state on (date)?" The file containing the changes is deleted so the changes really do go away.

For critical data, you may want to rely on your regular backup strategy and restore the files from there. Unfortuntately I used this firsthand from having my laptop stolen.

mi_sat
Contributor
Contributor

It's a lesson to myself not to do things at 5:00 a.m. I obviously missed the warnings about Snapshot, as well as the more obvious use of System Restore, as you point out.

Next time I'll wait until the later of 7:00 a.m. or three cups of coffee.

Reply
0 Kudos
oreeh
Immortal
Immortal

If you are lucky you can undelete the snapshot files and we are able to reconstruct the snapshot.

Though no guarantee on that!

mi_sat
Contributor
Contributor

That sounds promising. How might I go about that?

Reply
0 Kudos
oreeh
Immortal
Immortal

First: I don't have a clue about Mac OS-X - so you are on your own with that.

You first need to undelete the old snapshot file (see above).

Now comes the part where I'm able to help.

After undeleting the files (if they are recoverable at all) we only have to modify the CID chain to put the snapshot back in place.

After that you can extract the data from the VM and remove the snapshot again (for safety reasons).

Reply
0 Kudos
rcardona2k
Immortal
Immortal

That sounds promising. How might I go about that?

The undelete part is the riskest part of attempting. Two good undelete utiltiies are SubRosaSoft's FileSalvage and Prosoft's Data Rescue. They aren't free so you'll have to gamble on a purchase too. Good luck!

Reply
0 Kudos
admin
Immortal
Immortal

If you're going to try undeleting, try not to use the computer until you're ready to undelete, because any later disk writes could overwrite your files (Normally when you delete a file, only the metadata is deleted; an undelete program can scan the drive for things that look like files).

Reply
0 Kudos
macmick
Contributor
Contributor

I am a novice to VM Fusion and have the same problem of "mi-sat" (Sept 28). I reverted to a snapshot without realizing that it would also revert my Quickbooks data back 3 months! I am trying to recover or undo this damage. Your response to "undelete" and "reconstruct" snapshot sounds worth trying but how specifically do you do this? I am on an iMac running Fusion so I can use my Quickbooks. I do have ProSoft Data Rescue II but do not know what I need to search for. Any help?

Reply
0 Kudos
WoodyZ
Immortal
Immortal

When something like this happens if you do not immediately attempt to recover you severely lessen your chances of a successful recovery. If you have continued to use the system for any length of time you can just about forget recovering.

QuickBooks prompts on a regular basis to make off-system backups. My question to you is why don't you just restore your quickbooks data from the off-system backups you're suppose to make on a regular basis when using accounting software?

Reply
0 Kudos
admin
Immortal
Immortal

Exact undelete instructions vary by product, you need to look up ProSoft Data Rescue's help or ask in a forum that's dedicated to them. If you are able to undelete it we may be able to help you get it working again (no guarantees).

Reply
0 Kudos
admin
Immortal
Immortal

While it's all well and good to say that "You should have backups! Why don't you have backups?!", it doesn't help after the fact (though it might help in the future). I sheepishly admit that even though I know the importance of backing up, I don't really do so, which has just recently come back to bite me in the last few weeks when my MacBook's drive suffered an unrecoverable head crash.

Reply
0 Kudos
rcardona2k
Immortal
Immortal

I do have ProSoft Data Rescue II but do not know what I need to search for. Any help?

Backup posturing aside (tsk, tsk), the files you're looking for in Data Rescue II are:

vm name -SnapshotXX.vmsn

vm name -SnapshotXX.vmem (if powered on at the time of the snapshot)

vm name -0000001.vmdk

These belong inside the VM bundle, e.g. Documents > Virtual Machines > VM bundle icon > (Show Package contents - via control-click, or right mouse click in the Finder)

Reply
0 Kudos
Smyly
Contributor
Contributor

Like the person you were assisting, I too inappropriately used the Revert to Snapshot function and am now trying to recover the deleted files. Once recovered what are the next appropriate steps to bring back my data -- you refereed to CID chain modifications?

Thanks

Reply
0 Kudos