Raw recovery on VMFS, need file signatures.

[Emusp]

Hi

I need to do a raw recovery on a VMFS volume.

I use Ontrack Data Recovery pro software to do the job.

The software knows a lot of file types, but i need the VM files (.vmdk, .vmx .nvram ect...).

There is a a way you can add file types, but it need to know the following:

1) Signature in hex format with maximum of 8 bytes. (i.e 1A 00 00 03 00 00 14 00)

2) Signature Offset.

Anybody who knows, how I can find the signature of the VM files?

//Casper

[continuum]

I have made a list here

http://sanbarrow.com/vmdk-experts.html#scanforvmdkfiles

You will probably not have useful results by scanning for VMware files such as vmdks. This is only useful on almost blank vmfs-volumes where you can assume that the files are not fragmented. For populated vmfs-volumes using Ontrack to scan for vmdks is a waste of time.

You may find bits and pieces but as you can not assemble them to the full vmdks it does not help.

I use Ontrack for recovering files from vmfs as well - but I do not search for vmware-files - I directly search for the files I need to recover.

So if you need to recover "mission-critical.db" from myserver.vmdk - directly scan for *.db files




___________________________________

VMX-parameters- WS FAQ -[ MOAcd|http://sanbarrow.com/moa241.html] - VMDK-Handbook