Recovering data from delta.vmdk with missing snapshots

[Sadomba]

My datastore on an ESXi 6.0 host was filling up rapidly. i discovered that one of my Vms had many snapshots thus chewing up much of the space on the datastore. Deleting snapshots from GUI yielded no results, i had to ssh to delete them. After deleting them my VM could not start, citing missing snapshots. I resorted to mounting the flat file and i succeeded in booting up my VM. after checking everything i found out that i have lost much of my data. How can i recover the missing data or some of it from the snapshots i have. i have 2 snapshots out of 7.

[SupreetK]

continuum​ might help you with the recovery

Cheers,

Supreet

[continuum]

> I resorted to mounting the flat file and i succeeded in booting up my VM.
Bad idea - how long did you operate the VM in that mode ?
Hope you did not run chkdsk or allowed a Windows-update.
Anyway - what is the size of the basedisk and what is the size of the delta-files that you still have ?
We will need:
vmware.logs
all VMDK-descriptorfiles
a list of all files - make sure to display the full names and include the size of the files.
Generally speaking it is possible to extract data from snapshots - but the chances for success depend on many factors.
If you really deleted 5 deltafiles manually the chance to get really useful results is quite limited ( assuming the files you deleted were no orphans )

[Sadomba]

find below answers to your questions

attached are the logs and descriptor files

Bad idea - how long did you operate the VM in that mode ?  its 48 hours now since the VM has been on

Hope you did not run chkdsk or allowed a Windows-update. No chkdsk and windows updates

Anyway - what is the size of the basedisk and what is the size of the delta-files that you still have ? base file 1.6TB, delta1 is 129GB and delta2 is 22GB

We will need:

vmware.logs

all VMDK-descriptorfiles

a list of all files - make sure to display the full names and include the size of the files.

[Sadomba]

Lots of questions ....
- "to server" ? - is the server an ESXi ? ESXI 6.0
- which tools did you try so far ? i used ssh to delete the delta files
- do  you power the VMs off before you try ?  yes
My favorite tool to get large files from or to ESXi is ddrescue: can be resumed when it aborts and does something useful if it runs into errors.

[continuum]

Power off the VM.
Replace the 3 vmdk-descriptorfiles with the files I edited for you.
Then you should clone the 2 deltas plus the basedisk into a new temporary standalone VMDK.
The result will not be good enough to run as a serious VM but hopefully good enough to extract some data from it using recovery tools.
To do:
- replace the 3 descriptorfiles
- log in as a root via putty
- change directory to the VMs location
vmkfstools -i DC-SRV-000007.vmdk  TEMPORARY-basedisk.vmdk -d thin
as we create a clone make sure you have enough free space - you may need upto 1.6 TB
If you do not have enough free space - create  TEMPORARY-basedisk.vmdk on another datastore.
When the clone is done - attach the new VMDK to a helper VM.
First run a chkdsk /f /x /r /v against the volume. In the expected state I assume that it will be impossible to display the NTFS-content before chkdsk.
Report any problems along the way please.