regis1860
Contributor
Contributor

Recover lost VMWare Files after formatted external drive

Hi, good evening.

'Firstly i say sorry if i opened this topic in an incorrect forum. I have searched several topics but can't find any similar issue.

I use vmware workstation with a Windows 7 virtual machine saved on an external drive. I needed to create a bootable pen drive for Windows 10 installation, but accidentally selected the external disk and it was formatted. After that, i have already used various data recovery tools (Recuva, Disk Drill, SysTools Hard Drive Data Recovery, VMFS recovery, etc...) but none of them was able to find .vmdk files.

The problem is, i can find the S.O. (Win7) as file system and i can see all directories and files locate inside the VM. But if i try recover any file, i cannot open it. I see that the files are complete and have dates the last time I used the virtual machine, but I cannot restore them.

Has anyone had this problem or any suggestions on how to restore the files or even the virtual machine?

Thank You.

Regis.

5 Replies
continuum
Immortal
Immortal

If you do a signature based scan the "vmdk" signature will only find Workstation sparse vmdks.
All ESXi-vmdks or all monolithicFlat Workstation vmdks would not be found with such a scan.


________________________________________________
Do you need support with a VMFS recovery problem ? - send a message via skype "sanbarrow"
I do not support Workstation 16 at this time ...

regis1860
Contributor
Contributor

Hi continuum, thanks for answer.

Sorry, I didn't understand. Would a signature-based check to be using a tool which support search for .vmdk files?

I used DiskGenius and it supports vmdk files, but when I search only for this type of file it doesn't find anything. If I do a general search on disk, without filtering by vmdk files, it finds the files of the virtual machine as a filesystem (users, program files, etc ...).

How do I get this way that you suggested?

0 Kudos
continuum
Immortal
Immortal

Hi
I need to know which vmdk-type you have stored on NTFS.
If it comes from ESXi it uses a format like a dd umage of a full disk.
To find such an image you dont search for the vmdk signature but for a GPT or MBR signature.
If I understand you correctly you used scan procedures so far that looked for user files.
These types of scan will detect files inside those diskimages. But if they read the files without using the NTFS-metadata of the original diskimage they cant detect fragments and so the data will be more or less corrupted.
Anyway I need detailed info about the file you deleted to suggest the best approach.


________________________________________________
Do you need support with a VMFS recovery problem ? - send a message via skype "sanbarrow"
I do not support Workstation 16 at this time ...

regis1860
Contributor
Contributor

Hi continuum!

The vmdk file was configured as SPLIT_SPARSE. The files was split into 2GB expansion (files had more than 2GB, approximately 4GB, though) and the disk was using a scsi device node as PERSISTENT.

These information i got from another virtual machine with W7 that i had used in my office. When i have created that vm i used the same configuration.

How i can search using GPT or MBR signature? Would it be like search for recover partition formatted? Do you have suggestion which tools i can use to do it?

One more time, thank you so much for the help.

0 Kudos
continuum
Immortal
Immortal

Damn - so we have the worst case scenario.
The slices of a split-sparse vmdk usually are highlty fragmented on the NTFS-volume.
This means we can forget the hope of recovering the complete vmdk.Instead you should make up your mind which filetypes you need most desparately.
We will then use freeware-tools to look at those files in particular.
If you have not already done so - I would suggest to download the trial version of UFSexplorer and scan the disk with that tool.
Back to the split-sparse vmdks .....
We can search for this filetype by looking for the signature KDMV. But that will not help a lot as we will find more false positives than valid fragments.
Also we do not know their size and must assume that all slices are fragmented.
So we would end with lots of pieces that start with KDMV but we neither know wether they belong to the missing vmdk nor do we know the correct order.
Feel free to call me via skype - a remote session via Anydesk may be useful.
Ulli


________________________________________________
Do you need support with a VMFS recovery problem ? - send a message via skype "sanbarrow"
I do not support Workstation 16 at this time ...

0 Kudos