Workstation 16.1.1 Pro Defragment guest hard disk error and now missing VMDK

[SimonJMBrown]

Hello

Host hard disk getting low on space so I decided to defragment VM drives

First one, against a pre-allocated 80gb drive gave me an error I was not expecting...

This is my main development VM so had all my Visual Studios and code on it.

After that I tried to start VM to look at why it determines a virus or unwanted software (not being explicit here?)

I then discovered the process had deleted the file for the host.

The Windows 10 Dev-00004.vmdk file was gone, not showing in folder or recycle bin.

Any ideas why this would occur and if this is recoverable?

In true error style, my backup is a few weeks old and I had a couple of code projects with lots of work done that I had not committed yet

[SchaalPatrick]

@SimonJMBrown 
Wich Antivirus you Use on Host?
Check quarantine folder if 3rp Part Antivirus

[SchaalPatrick]

@SimonJMBrown 
Do NOT start the VM! while the Defragment Operation was not finished.
you’ll have to temporarily disable Windows Defender (or 3rd Party AntiVirus), and run VMWare Defrag (Again) while it’s turned off.

[SimonJMBrown]

The defrag had finished, with the error message.

The VM was off

[SchaalPatrick]

@SimonJMBrown 

You can Check if Data can be Restored
Data Recovery Software for SSD Data/File Recovery
It recovers formatted, deleted, or lost files and NTFS/FAT partition data on SSD
Surce: https://www.easeus.com/data-recovery/other-recovery-software/SSD-drive-recovery.htm 

[SchaalPatrick]

Wich Antivirus you Use on Host?
Check quarantine folder if 3rp Part Antivirus

[SimonJMBrown]

Windows defender but nothing showing there for threats or viruses.

[SchaalPatrick]

You Checked the followin Steps?

Recover deleted data from Windows Defender Windows Defender Antivirus is configured to detect and fix the threats on your device. Windows Defender Antivirus quarantines suspicious files. If you are sure that these files are not a threat, you can restore them.
Please follow the following steps:
1. Open Windows Security.
2. Click Virus & Threat Protection, and then click Threat History.
3. Under Quarantine threats, click Full History.
4. Click the files you want to keep, and then click Restore. 

[SimonJMBrown]

I had checked there, nothing in history. Does not look like windows/Anti virus determined this error message.

Feels like VMWare has and deleted file.

I am not sure if others have been, not got past this one yet.

Is there any type of audit log of these activities to understand what Workstation has done?

[SchaalPatrick]

Check if *.vmdk-dfgshkgrw-tmp inside of VM Folder.
Ceck if Folder *.vmdk.lck -> Lock File of Virtual Disk
run dir d:\*.* > filelist.txt and attach the resulting filelist.txt to a reply post
Also add *.vmx - Config-File of VM

[SchaalPatrick]

@SimonJMBrown 

Q: "Is there any type of audit log of these activities to understand what Workstation has done?"
A: No, Defrag will not be logged

[SimonJMBrown]

Ok, so even though says file missing, it is there and I can browse to it and starts VM but then get warning.

Looking at the 000004 file I notice that one entry is physically missing;

RW 8323072 SPARSE "Windows 10 Dev-000004-s017.vmdk"

I had earlier removed a snapshot through snapshot manager. I can only assume S017 was that file. 

I did try removing that entry from the .vmdk but still fails.

I looked at parent .vmdk referenced in 000004 file and that one, and its parent files all exist.

To your questions:

No -tmp file in folder

There is a lck file, i have seen this before, renaming it aside and trying to load VM again made no difference.

files output attached and the .vmx renamed to allow attaching here.

Thanks for assistance so far, my backup is older than I thought

/edit

Added 000004 file as requested

[SchaalPatrick]

THX for the Files.

Please also Upload the "Windows 10 Dev-000004.vmdk" Config File of VM Disk

[SchaalPatrick]

Use the following command:

First of all Make a Backup of the Folder!

Run as Administrator inside of Dos Box
"C:\Program Files (x86)\VMware\VMware Workstation\vmware-vdiskmanager" -R "C:\Users\simon.brown\Documents\VMWare\Windows 10 Dev\Windows 10 Dev-000004.vmdk"

To repair a virtual disk of a Workstation virtual machine in a Windows host, use the vmware-vdiskmanager utility that is installed by the Workstation installer in the installation folder on a Windows host.

Repairing a virtual disk in Workstation (2019259)
Source: https://kb.vmware.com/s/article/2019259 

[SimonJMBrown]

Tried repair line, comes back instantly.

Trying to load VM again I get a new error;

/edit

All new to me this, not finding much on how to resolve a parent-child issue mentioned.

I tried the -e option to diskmanager and it gives more info, but I don't see a way of correcting the problem. Seems good at telling me the issue but not at pointing in right direction to resolve, better still a tool to fix!

C:\Program Files (x86)\VMware\VMware Workstation>vmware-vdiskmanager.exe -e "C:\Users\simon.brown\Documents\VMWare\Windows 10 Dev\Windows 10 Dev-000004.vmdk"
Failed to open the disk 'C:\Users\simon.brown\Documents\VMWare\Windows 10 Dev\Windows 10 Dev-000004.vmdk' : The parent virtual disk's capacity is not the same as child's capacity (0x3ec3).
Disk link C:\Users\simon.brown\Documents\VMWare\Windows 10 Dev\Windows 10 Dev-000004.vmdk successfully opened.
Disk link C:\Users\simon.brown\Documents\VMWare\Windows 10 Dev\Windows 10 Dev-000001.vmdk successfully opened.
Cannot establish parent(C:\Users\simon.brown\Documents\VMWare\Windows 10 Dev\Windows 10 Dev-000001.vmdk) - child(C:\Users\simon.brown\Documents\VMWare\Windows 10 Dev\Windows 10 Dev-000004.vmdk) relationship: The parent virtual disk's capacity is not the same as child's capacity (0x3ec3).
Parent link description
Name: C:\Users\simon.brown\Documents\VMWare\Windows 10 Dev\Windows 10 Dev-000001.vmdk
Create Type: twoGbMaxExtentSparse
Capacity: 85899345920
Content ID: 2832678526
Parent Content ID: 2859411184
Child link description
Name: C:\Users\simon.brown\Documents\VMWare\Windows 10 Dev\Windows 10 Dev-000004.vmdk
Create Type: twoGbMaxExtentSparse
Capacity: 81637933056
Content ID: 1428822893
Parent Content ID: 870683872
Disk link C:\Users\simon.brown\Documents\VMWare\Windows 10 Dev\Windows 10 Dev.vmdk successfully opened.
Disk chain is not consistent: The parent virtual disk's capacity is not the same as child's capacity (0x3ec3).

[wila]

Hi,

Stop messing with vmware-vdiskmanager.. it won't fix this.
It's how you lost the disk slice in the first place.

Also fix back your -000004.vmdk file back to the original state with the missing slice.
You can't just remove a disk slice and expect things to work. It won't.

Finally ... in order to resolve:

Create a new VM with the EXACT same disk size as your current VM with problems.
It should have the same data in the .vmdk file as your -000004.vmdk.
Same amount of slices and same size. The "8323072" in your original RW 8323072 SPARSE "Windows 10 Dev-000004-s017.vmdk" line.

When that's true... take slice 17 and rename it "Windows 10 Dev-000004-s017.vmdk".

Copy it into your broken VM.

Note that there will be data loss as a whole slice has gone missing.
But with the notes above you should be able to get the VM to be recognized again.

Oh and .. yes DO MAKE A BACKUP before you start making changes and experiment.

--
Wil

[SimonJMBrown]

Thanks for attempts to help, nothing worked so now having to go back to old backup and take consequences.

Workstation caused this problem simply using built in defragrmentation option decided I had a virus (pretty **bleep** sure wasn't, dev machine with VS, Postman, Node.JS etc).

That is what removed the slice.

@wila diskmanager was tried much later in the process to try and recover, it was not the cause. The slice replace didn't work either. Started to load VM but then errors and windows options to repair appeared, tried all the options but none would work

Not first time had workstation "utilities" cause problems. Its great when working as intended, awful when a problem.

 Lession learn't, make more frequent backups and DEFINATELY dont use any of the VMWare tools until a backup done as well.

[SchaalPatrick]

@SimonJMBrown 

More Backup - Very Good Idea!

But you have one more undocumented option, you can use the VSS (Volume shadow Copy Services) when the HOST is an Windows.
I use this Option as long Time ago. Create a new Task scheduler:
wmic shadowcopy call create Volume=c:\
wmic shadowcopy call create Volume=d:\
you need only "C:\" your VMWare data are stored on "C:\"
Run on Fixed Times (As Logon User) and on Startup (As Lokal-Admin)

So you can very fast get a Restore of any missing Data..
see attached Pics