vmdk File Not Found

[Burlington_Paul]

Hello,

I shut my VM down and my host down like I normally do. This morning when I came in, the PC booted as normal, but when I tried to boot the VM I get the message...

"Unable to open .vmdk":

"The system cannot find the file specified"

VM was working great since Sept 27 2021 up until this morning.

I can see the vmdk file, it is 4KB.

I have a back up from Mar 29 2022.

[scott28tt]

Presumably this is with VMware Workstation? (Since you mentioned having a PC)

[Burlington_Paul]

Yes, I am sorry, it is VMWare Workstation Pro 15.5.

[scott28tt]

Expect a moderator to move your thread now that I’ve reported it, since this has nothing to do with a vSphere security advisory.

You should also post a detailed file listing of the folder in which the VM lives.

[Burlington_Paul]

Okay, thanks.

Sorry again, I didn't realize I was in the wrong group.

04/22/2022 10:10 AM <DIR> .
04/22/2022 10:10 AM <DIR> ..
11/12/2021 08:26 AM <DIR> caches
04/20/2022 04:03 PM 337,433 vmware-0.log
04/19/2022 04:25 PM 446,273 vmware-1.log
04/18/2022 04:15 PM 313,996 vmware-2.log
04/21/2022 04:27 PM 411,054 vmware.log
04/21/2022 04:27 PM 6,622,150,656 Windows 10 x64 New Rockwell Aug 27 2021-s001.vmdk
04/21/2022 04:27 PM 5,874,974,720 Windows 10 x64 New Rockwell Aug 27 2021-s002.vmdk
04/21/2022 04:27 PM 6,711,738,368 Windows 10 x64 New Rockwell Aug 27 2021-s003.vmdk
04/21/2022 04:27 PM 6,711,738,368 Windows 10 x64 New Rockwell Aug 27 2021-s004.vmdk
04/21/2022 04:27 PM 6,711,738,368 Windows 10 x64 New Rockwell Aug 27 2021-s005.vmdk
04/21/2022 04:27 PM 6,705,512,448 Windows 10 x64 New Rockwell Aug 27 2021-s006.vmdk
04/21/2022 04:27 PM 6,711,738,368 Windows 10 x64 New Rockwell Aug 27 2021-s007.vmdk
04/04/2022 08:38 AM 6,711,738,368 Windows 10 x64 New Rockwell Aug 27 2021-s008.vmdk
03/29/2022 07:49 AM 6,711,738,368 Windows 10 x64 New Rockwell Aug 27 2021-s009.vmdk
04/21/2022 04:27 PM 6,711,738,368 Windows 10 x64 New Rockwell Aug 27 2021-s010.vmdk
04/21/2022 04:27 PM 6,711,738,368 Windows 10 x64 New Rockwell Aug 27 2021-s011.vmdk
04/21/2022 04:27 PM 6,710,034,432 Windows 10 x64 New Rockwell Aug 27 2021-s012.vmdk
04/21/2022 04:27 PM 6,711,738,368 Windows 10 x64 New Rockwell Aug 27 2021-s013.vmdk
04/21/2022 04:27 PM 6,461,259,776 Windows 10 x64 New Rockwell Aug 27 2021-s014.vmdk
04/21/2022 04:27 PM 6,134,628,352 Windows 10 x64 New Rockwell Aug 27 2021-s015.vmdk
04/21/2022 04:27 PM 6,597,050,368 Windows 10 x64 New Rockwell Aug 27 2021-s016.vmdk
04/21/2022 04:27 PM 6,711,738,368 Windows 10 x64 New Rockwell Aug 27 2021-s017.vmdk
04/21/2022 08:02 AM 6,711,738,368 Windows 10 x64 New Rockwell Aug 27 2021-s018.vmdk
04/21/2022 04:27 PM 6,711,738,368 Windows 10 x64 New Rockwell Aug 27 2021-s019.vmdk
04/21/2022 04:27 PM 5,998,903,296 Windows 10 x64 New Rockwell Aug 27 2021-s020.vmdk
04/21/2022 04:27 PM 6,711,148,544 Windows 10 x64 New Rockwell Aug 27 2021-s021.vmdk
04/21/2022 04:27 PM 5,997,133,824 Windows 10 x64 New Rockwell Aug 27 2021-s022.vmdk
04/21/2022 04:27 PM 6,352,207,872 Windows 10 x64 New Rockwell Aug 27 2021-s023.vmdk
04/21/2022 04:27 PM 6,711,672,832 Windows 10 x64 New Rockwell Aug 27 2021-s025.vmdk
04/21/2022 04:27 PM 6,489,047,040 Windows 10 x64 New Rockwell Aug 27 2021-s026.vmdk
04/21/2022 04:27 PM 6,711,607,296 Windows 10 x64 New Rockwell Aug 27 2021-s027.vmdk
04/21/2022 12:38 PM 6,711,738,368 Windows 10 x64 New Rockwell Aug 27 2021-s028.vmdk
04/21/2022 04:27 PM 5,713,952,768 Windows 10 x64 New Rockwell Aug 27 2021-s029.vmdk
04/21/2022 04:27 PM 3,579,641,856 Windows 10 x64 New Rockwell Aug 27 2021-s030.vmdk
04/21/2022 04:27 PM 6,161,104,896 Windows 10 x64 New Rockwell Aug 27 2021-s031.vmdk
04/21/2022 04:27 PM 1,531,904,000 Windows 10 x64 New Rockwell Aug 27 2021-s032.vmdk
03/29/2022 07:54 AM 1,245,184 Windows 10 x64 New Rockwell Aug 27 2021-s033.vmdk
03/29/2022 07:54 AM 1,245,184 Windows 10 x64 New Rockwell Aug 27 2021-s034.vmdk
03/29/2022 07:54 AM 1,245,184 Windows 10 x64 New Rockwell Aug 27 2021-s035.vmdk
03/29/2022 07:54 AM 1,245,184 Windows 10 x64 New Rockwell Aug 27 2021-s036.vmdk
03/29/2022 07:54 AM 1,245,184 Windows 10 x64 New Rockwell Aug 27 2021-s037.vmdk
03/29/2022 07:54 AM 1,245,184 Windows 10 x64 New Rockwell Aug 27 2021-s038.vmdk
03/29/2022 07:54 AM 1,245,184 Windows 10 x64 New Rockwell Aug 27 2021-s039.vmdk
03/29/2022 07:54 AM 1,245,184 Windows 10 x64 New Rockwell Aug 27 2021-s040.vmdk
03/29/2022 07:54 AM 1,245,184 Windows 10 x64 New Rockwell Aug 27 2021-s041.vmdk
03/29/2022 07:54 AM 1,245,184 Windows 10 x64 New Rockwell Aug 27 2021-s042.vmdk
03/29/2022 07:54 AM 983,040 Windows 10 x64 New Rockwell Aug 27 2021-s043.vmdk
04/21/2022 04:27 PM 270,840 Windows 10 x64 New Rockwell Aug 27 2021.nvram
04/21/2022 07:47 AM 3,541 Windows 10 x64 New Rockwell Aug 27 2021.vmdk
08/27/2021 09:05 AM 0 Windows 10 x64 New Rockwell Aug 27 2021.vmsd
04/21/2022 04:27 PM 4,462 Windows 10 x64 New Rockwell Aug 27 2021.vmx
04/22/2022 10:09 AM <DIR> Windows 10 x64 New Rockwell Aug 27 2021.vmx.lck
11/12/2021 08:32 AM 3,885 Windows 10 x64 New Rockwell Aug 27 2021.vmxf
51 File(s) 194,331,760,124 bytes
4 Dir(s) 1,126,786,768,896 bytes free

[scott28tt]

Looks like you’re missing disk slice s024

Do you have a backup?

If not, you’ll need to wait for one of the recovery expert users to spot this thread and offer help.

[Burlington_Paul]

I have a backup from Mar 29th, 2022.

[Burlington_Paul]

[continuum]

Replace the missing slice with a copy from that backup you mentioned.
Read vmdk-descriptorfile to figure out if there are slices missing at the end of the list.

[Burlington_Paul]

Thank you Continuum for the reply.

I am not sure if you saw my Windows Defender screen shot?

[continuum]

Thats the price you pay for not excluding vmdks from your antivirus ...
Anyway - create dummy VM with a vmdk of the same size and use a copy from that to replace the damaged slice.

Ulli

[Burlington_Paul]

Can I restore the file from Windows security under actions?

[continuum]

Why would you want to do that ?
Apparently you used that VM to download warez or keygens - or similar - and caught a downloadtrojan.
You dont want to have such stuff in your VMs.
I would suggest to throw away the complete VM - it may be filled with malware ...

Ulli

[Burlington_Paul]

Because I think this must be a false positive, how can Windows Defender detect a virus inside a VMDK slice file?

FYI - I did not download a keygen or warez program, I do not pirate software for two reasons, one it is unethical, two it is a sure way to get a virus.

Also, at my company, such actions are grounds for immediate termination.

This VM is used by me at my place of employment for software development, it is all legit.

There are other ways to get a virus...

Malicious email, USB drop attack, Website exploits.

[continuum]

> Because I think this must be a false positive, how can Windows Defender detect a virus inside a VMDK slice file?
Sparse vmdks contain do not behave like archives. They contain small files in their original format.
If a piece of malware is small enough they can be detected in sparse vmdks.

Sorry - I did not want to accuse you of any wrong doing.

Ulli

[Burlington_Paul]

Resolution found by locating slice file in Windows Defender quarantine.

Restored slice file, and VMDK file missing error went away and VM booted.

Added exclusions to VM files in Windows Defender.

Will run full Windows Defender scan shortly.

Thanks for the help.

Paul