recover data from vmdk file

[rwxr_xr_x]

Hello,

I'm trying to recover a vmdk file or get data out of it. When i try:

vmware-vdiskmanager.exe -e YYY.vmx

Failed to open the disk 'YYY.vmx' : The file specified is not a virtual disk (0xf00003ebf).

Failed to open the disk 'YYY.vmx' : The file specified is not a virtual disk (0xf00003ebf).

Disk chain is not consistent: The file specified is not a virtual disk (0xf00003ebf).

if i try to run it againt the vmdk file itself, not the -sXXX.vmdk, I get the same error.

If I try to mount it I get:

vmware-mount.exe k: YYY.vmdk

Unable to mount the virtual disk. The disk may be in use by a virtual machine, may not have enough volumes or mounted under another drive letter. If not, verify that the file is a valid virtual disk file.

The disks and VM machine is in suspended mode.

Is there anything that I can do to recover the data in the vmdk files?

Thank you.

[WoodyZ]

You have some choices, one is to copy (not move) all .vmdk files to a separate folder so as to have a backup of the virtual hard disk and then attempt to mount it of add it to another VM to peruse its contents or you can just delete the .vmss suspended state file and then try mounting it.

[rwxr_xr_x]

I tried tho rename the vmss file and the start the VM but I get "The file specified is not a virtual disk.". I get a similar error when i try to add it as a virtual disk to another VM.

[WoodyZ]

Okay lets start by providing the vmware.log files and a file listing of the VM showing filename, size and date/time stamp.  Also if the virtual hard disk is not monolithic and is a twoGbMaxExtentSparse type disk then include the base .vmdk file and if there are snapshots then include the base .vmdk files for those as well.  (These are typicaly small ~4KB files for the twoGbMaxExtentSparse type disk.)   Archive (compress) all requested information into a single .zip archive file and attach to a reply post.

[rwxr_xr_x]

please see attached the requested logs. I had re replace some names in the files to anonimize the data, the placeholder is "usernam".

Let me know if you need anything else.

The VM was not started for a while.

[WoodyZ]

Your missing the first two binary extents of the usernamfs.vmdk virtual hard disk, usernamfs-s001.vmdk and usernamfs-s002.vmdk and this is why you're getting the not a virtual disk error.  If you don'y have a full backup of the usernamfs.vmdk virtual hard disk, this file and the 21 binary extents then you're effectively dead in the water for this particular disk.  You can try taking the usernamfs-s003.vmdk extent and copying to usernamfs-s001.vmdk and usernamfs-s002.vmdk in an attempt to try and mount the disk for data recovery however usually when the first extent is gone so it the disk as it usually contains the partition table and MFT if it's an NTFS formated disk, etc.

The usernamfs-shared_f.vmdk virtual hard disk might be okay and I'd trying mounting it to see, this is assuming an NTFS file system.

[rwxr_xr_x]

Running:

vmware-vdiskmanager.exe -R usernamfs-shared_f.vmdk

NOT_IMPLEMENTED d:/build/ob/bora-774844/bora/lib/disklib/sparseChecker.c:1634

Win32 object usage: GDI 4, USER 1

CoreDump: Writing minidump to XXX\vmware-vdiskmanager-11128.dmp

vmware-mount.exe l: usernamfs-shared_f.vmdk

NOT_IMPLEMENTED d:/build/ob/bora-321140/bora/lib/disklib/sparseChecker.c:1634

I'm more interested in mounting "usernamfs-shared_f.vmdk" than "usernamfs.vmdk" since "usernamfs-shared_f.vmdk" contains the data that I want to restrieve.

[WoodyZ · Accepted solution]

What I'd try is creating a Linux Live OS VM booting from a Linux Live OS ISO Image with the HDD pointing to usernamfs-shared_f.vmdk and see if you can see the contents of the disk.  I use either Knoppix or Slax for this however any Linux Live OS that will automatically recognize and be able to mount the virtual hard disk is fine.  Another way to try getting a look and maybe even retrieving some user dates is opening the .vmdk with WinImage as it usually doesn't perform the in depth checking that vmware-mount does.

[rwxr_xr_x]

Thank you WoodyZ, you helped me retrieve most of the data from the vmdk. This is great. I ended up using WinImage to extract the data.

Once again thank you.