Missing/deleted base VM: can't start cloned VMs

[Roland_Online]

Hi everyone.

I have five VMs (all guest OS are Windows XP SP2) that were created as clones from an original base VM.

The original VM was called "Windows XP Professional" and the five clones are:

Windows XP Pro Current Applications

Windows XP Pro Lighting

Windows XP Pro VS2003 Development

Windows XP Pro VS2008 Development

Windows XP Professional HxDx Development

I haven't encountered any major problems until yesterday when I went to start "Windows XP Pro VS2008 Development" and it first reported that it couldn't obtain a memory lock (or some message like that).

So I removed the .lck file and folders as per the suggested remedy on this forum for this problem. When I restarted VMWare and attempted to start the same VM it then complained that the .vmx of the base VM ("Windows XP Professional") could not be found, and that it was needed to be able to start the cloned VM.

Panic!!

It was right: there was no sign of the "Windows XP Professional" VM files or folder: it has totally vanished - so I really would like some help here please!

Having read "What to do in moments of crisis" here's what I have done/not done:

1. I have NOT subsequently re-run VMWare.

2. I have NOT run vmware-mount-tool or vdk.exe or snapshotmanager.

3. I have NOT run vm-support.vbs (I didn't want my disk written to in any way before attempting undelete).

4. I HAVE used an undelete tool (R-Studio) and recovered some of the deleted "Windows XP Professional" files (see below) to another PC.

5. I have NOT copied the recovered files back to their original location (again, I am avoiding writing to the disk until necessary).

6. I HAVE backed up the five cloned VMs to another PC.

So, I'd be very grateful to know:

1. How or why this happened?

2. How to resolve the problem using the recovered "Windows XP Professional" VM files so that all the cloned VMs work again, and/or:

3. How to separate the clones for the base so that they can work standalone, without the base VM.

4. As a last resort, be able to access the VM volumes from the host so that I can recover my data, then rebuild a new set of VMs.

Here's the rest of the technical info you other smarter people than me might need:

Host Computer: Dell Inspiron 1720

Host OS: Windows Vista Home Premium

VMware: VMware Workstation v6.0.2 build 59824

I have zipped up and attached all the vmx, vmxf, vmdk, vmsd, nvram and log files for all six VMs.

Also included is a complete dir output of folders and files for the remaining five VMs in vm_files_virtual_machines.txt

The "Windows XP Professional" VM files recovered are listed in vm_files_windows_xp_pro_recovered.txt

However, it seems that of the files recovered, the following ones appear to have corrupted contents (their recovered file size is different to thier original file size reported by R-Studio):

Windows XP Professional-000001-s003.vmdk

Windows XP Professional-000002-s003.vmdk

Windows XP Professional-000002-s004.vmdk

Windows XP Professional-000007-s001.vmdk

Windows XP Professional-000007-s002.vmdk

Windows XP Professional-000007-s003.vmdk

Windows XP Professional-000007-s004.vmdk

Windows XP Professional-000007-s005.vmdk

Windows XP Professional-000007-s006.vmdk

Windows XP Professional-000007-s007.vmdk

Windows XP Professional-000007-s008.vmdk

Windows XP Professional-000007-s009.vmdk

Windows XP Professional-000007.vmdk

Hope that's enough info for some kind soul to pick through and know what I should do next.

Many thanks in advance

Paul

[birdie]

Files usually don't disappear, so, I'm 100% sure someone or something has deleted them - and that wasn't VMWare itself. And this forum is not a forum for computer forensics.

Other than that you have nothing to do but to reinstall your base VM and all dependent VMs. And back up everything.

[Roland_Online]

Let me be very clear: I'm 100% sure those files were not deleted by me, and as I'm the only person using that machine, it was not a 'someone'.

Files do disappear because they get deleted. I've recovered some of those files and, computer forensics aside, would be grateful for someone's reasoned approach to a possible recovery.

I fail to believe that "reinstall Windows" can be the only solution to this.

The VMWare documentation states that cloning "creates an independent copy of the virtual machine from the snapshot." It goes on to say that deleting a snapshot "does not affect the deleted snapshot's children (those snapshots or recordings stemming from the selected snapshot)."

So that implies there is sufficient independence between the two for the clone to operate without the snapshot. Yet that's not my experience here.

Any further coments appreciated.

[continuum]

1. How or why this happened?

don't know yet

2. How to resolve the problem using the recovered "Windows XP

Professional" VM files so that all the cloned VMs work again

I need a more complete overview.

1. the last vmware.log from the failed start

2. verbose filelists - include size and date

Give me your phone-number if inside germany

edit:

sorry - while replying to last post I didn't saw your attachement - I'll look into it tomorrow

___________________________________

description of vmx-parameters:

VMware-liveCD: