VMware Cloud Community
KHP123
Contributor
Contributor

VM Deleted from DataStore - Please help

This is probably one of the worst disasters in a VM environment. One of the VM's was deleted from disk by mistake. Instead of being removed from inventory, the entire folder containing the VMDK was deleted from VMFS.

My intention was to free up some space in the datastore by shrinking some VM's which are no longer in use.  It turned out that one of the active one was chosen inadvertently. Here is the steps I have taken during the incident:

1. Shrank all partitions on the VM machines.

2. Ran VM converter to "create" a new VM (V2V) with reduced disk sizes in thin provisioning.

3. Shut down the original VM and delete it from disk.

A few hours later, I realized that the deleted VM actually has a live database.  I quickly powered up the shrunk version. While the OS appeared to be operational, drive 😧 and E: (set up as a second HDD) were showing as RAW.  Unfortunately, these two partitions contained the database and data files.

I tried some utilities but was unable to convert the RAW drives to NTFS.  Is there any way to recover the original VM files?  Any chance that I can recover the data?

Esxi Version : 6.5

VM OS:          Windows Server 2016

0 Kudos
5 Replies
daphnissov
Immortal
Immortal

And can we infer from your incident that you have no backups of this VM?

0 Kudos
KHP123
Contributor
Contributor

That is correct. That server was just built recently.  We were supposed to start backing it up once they are finished with more configuration changes.  Sadly we have just started to enter live data to it.

0 Kudos
a_p_
Leadership
Leadership

I'm afraid there's no big chance to restore the deleted .vmdk files. in this case

However, try to contact continuum​. He's an expert in data recovery. Maybe he's able to help with either a virtual disk recovery, or with extracting data from the secondary virtual disk.


André

0 Kudos
continuum
Immortal
Immortal

Hi Joe
unfortunately you used ESXi 6.5 - recovering deleted VMs is trickier then ever before with 6.5
Anyway - please create a VMFS-header-dump as soon as possible - see
Create a VMFS-Header-dump using an ESXi-Host in production | VM-Sickbay
If we are lucky we will still find the locations of the vmdks and can extract them manually.
If that does not work there is another rather small chance - it only works when the vmdks have been created thick provisioned and were allocated in one piece.
In such a case I can detect the start of the vmdk and extract it with dd.
If you want me to look into your case call me via skype "sanbarrow"
Ulli


________________________________________________
Do you need support with a VMFS recovery problem ? - send a message via skype "sanbarrow"
I do not support Workstation 16 at this time ...

0 Kudos
dekoshal
Hot Shot
Hot Shot

You may want to consider using data recovery option as mentioned in below  VMware KB article .

VMware Knowledge Base

If you found this or any other answer helpful, please consider the use of the Correct or Helpful to award points.

Best Regards,

Deepak Koshal

CNE|CLA|CWMA|VCP4|VCP5|CCAH

https://hackhands.com/dkoshal/

0 Kudos