Recreate .vmdk from partition s001.vmdk files

[igorbastosib]

Hello all,

My anti-virus deleted one of my VMDK files while I was using the virtual machine, then it got frozen, I re-started my PC and my VM was not able to run any more. I got really upset and worried, so I started working around, deleting some files that wasn't VMDKs and VMX file... I was able to recover the deleted file and it seems to be ok, I have all my 31 VMDK files, but the vm.VMDK seems to be wrong (for some reason)

Is there any way to fix my virtual disk?

I found this topic, but I wasn't able to follow his step-by-step tutorial and I've deleted the Log files (what made me more worried....)

https://communities.vmware.com/t5/VMware-Workstation-Pro/Recreate-vmdk-from-partition-s001-vmdk-file...

Can someone try to help me? please...

[a_p_]

Which file do you have in the VM's folder.

Please run dir *.* /one > filelist.txt in the VM's folder, and attach filelist.txt to your next reply.

André

[igorbastosib]

"new folder" is the folder that I have putting all extra files as logs, overriding them since I got the first issue (I'm telling it just to make sure that the logs might not be useful, since I'm overriding/deleting them a lot)

[a_p_]

Doesn't look bad.

What do you mean with "but the vm.VMDK seems to be wrong"?
Please attach the .vmdk descriptor file to your next reply (you may need to rename it to .txt)

André

[igorbastosib]

I don't know exactly what might be wrong with it, just doesn't work as a virtual disk anymore.

I tried to clone it, to 'map virtual disk' it, and all raises errors (attached)

I thought of some how, recreating the vmdk file from my other VMDK files, but I'm very lost right now ;(

[a_p_]

The descriptor .vmdk file seems to be ok, maybe it's an issue with one of the s00x.vmdk files.

Please extract the attached .zip archive to a new, empty folder, and drag&drop the VM's folder onto the .cmd file. This will extract the .vmdk files' metadata. Once done compress/zip the Metadata*.* files and attach the .zip archive to a reply.

André

[igorbastosib]

Follow zip file (I hope I did it right)

[a_p_]

"Windows 10x64-s013.vmdk" is corrupt. The header data has been overwritten with binary zeroes.

Please change $HeaderSize = 1536 to $HeaderSize = 524288 in Get-VmdkHeader.ps1, then drag&drop "Windows 10x64-s013.vmdk" onto the .cmd file again. Once you provide its new Metadata*.* file (zipped), I will take a look at it to see if it contains enough data to fix it.

André

[igorbastosib]

Follow the new required file

This 013.vmdk was the one that the AntiVirus deleted ¬¬ (I used Recuva free to recover it)

[a_p_]

I had to make a bunch of assumptions to at least fix the metadata,  but I can't tell you how much damage is in the user data.

I strongly recommend that - unless already done - you backup the VM's files/folder prior to doing the modification!

To inject the modified metadata into the .vmdk file, please download dsfi.exe from https://sanbarrow.com/files/dsfok.zip. With "dsfi.exe" and the extracted .bin file from the attached .zip archive in the VM's folder, run the following command.

dsfi.exe "Windows 10x64-s013.vmdk" 0 524288 "Metadata-Windows 10x64-s013-4261740544-fixed.bin"

Usage: dsfi.exe <destination> <offset> <size> <source>

Once done, either mount the virtual disk, and extract/backup important data, or at least create a VM snapshot prior to powering it on, so that the current files won't get modified.

André

[igorbastosib]

Maannnnn,

I can't thank you enough!

The file is fixed, I was able to go in the VM ❤️ ❤️

I'll check the important file and backup them, probably create a new VM,

Thank you so much for you time, help and patience!!!!

[ellswortj]

Can you tell me how you fixed the problem? I moved my vm to another disk and now most of the file have an invalid magic number.

[a_p_]

In the original case, it was just a metadata corruption that had to be fixed.

In your case it unfortunately looks like most files have either been overwritten, or are encrypted in some way.

André

[ellswortj]

Dang! Thanks for the help. Guess I'll be recreating my vm