Missing Disk?

[tailorbmw80]

Hi all,

wondering if you could help? one of our VM's has managed to delete its E:\ drive. Now looking for the virtual disk I can't see it in the datastore?

if there anyway of recovery this disk from the datastore?

thanks

[iamamit]

I think, If you have just remove the disk from inventory, you can still add that back to the VM. But If you have deleted it from disk/datastore, there is no option to recover it from VMware side.

You can consult recovery vendors if they can help..

Thanks,

Amit

[tailorbmw80]

Do you know of any programs you would recommend to do this?

[iamamit]

see if the below KBs helps you..  I have not done such restoration yet and If I remember my last similar incident with a test VM, VMware also don't have this feasibility..

https://www.diskinternals.com/vmfs-recovery/

https://communities.vmware.com/thread/430174?tstart=0

Thanks

Amit

[tailorbmw]

Is there anyway we can find what happened to that disk? logs or events?

[iamamit]

I tried re-producing the event of disk removal (delete from Disk), what log I found is as below:

Task: Reconfigure virtual machine (I know its not much informative but you can relate the events of vCenter server vs affected Virtual Machine, it can give an idea at least about who was the user to initiate this this event and accordingly you can trace who did what on this VM).

I am attaching a screenshot of the testing I did.

Please refer below KBs to get idea options available for checking logs in VMware..you can try, anyone of them should help in your case.

https://pubs.vmware.com/vsphere-55/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc%2FGUID-832A261...

https://pubs.vmware.com/vsphere-55/index.jsp?topic=%2Fcom.vmware.vsphere.monitoring.doc%2FGUID-498D2...

https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=20042...

Determining which user removed or deleted a virtual machine (2005478) | VMware KB

Additionally, If possible you can check with VMware support for quick conclusion.

Thanks,

Amit

[tailorbmw]

Thanks Amit,

The problem am having is the logs don't go back as last week in the Events TAB?

Is there a way to access it backend?

[iamamit]

You can try exporting events from vSphere Client with specific Date/Time frame..

In vSphere Client, Select your vCenter Server > go to File > Click on Export > Select Export Events > Select required Date/Time and Save the logs > You can now use log for tracing the activities.

See, if events are also not saved due any reason (e.g. Disk Space issue etc..), I am sorry.. Not Idea what else can be done in that case..

Thanks,

Amit

[tailorbmw]

Thanks Amit,

Its not really plan English the read the logs. They don't seem to make any sense to me.

All I wanted to know from it if or how this disk was deleted?

I've also tired to speak to support but unfortunately because we are using a FREE licence there isn't any support available for us.

Do you think a Data Recovery Company would be able to recovery the DATA?

[iamamit]

If that is urgent, you should speak to data recovery company for sure without any delay and as per some KBs available on Google, some of the vendors may help in this case..

I am working with VMware support for the same issue in my VM environment, please wait for my next update if you can.. Once I have any solution, I can share that with you..

I know there is no workaround from VMware side to recover the deleted VMDKs, but trying for your if I can something (whether it is about relevant log info or anything other clue) ..

Thanks,

Amit

[continuum]

A bit late - but anyway - maybe it is still useful ....
Recovering missing vmdks or complete VMs is my daily work so I just sum up some of the lessons I learned along the way.
Top 3 reasons why a vmdk disappears suddenly from a VMFS-volume:
1. user-mistakes by accidentaly using "delete from disk"
2. Raid5 array with a bad disk
3. power-failures

Useful esxi-buildin tools or logs for examing such issues:
None - at least I nowadays use neither voma nor do I spend much time at all to examine log-files.
First  things I do when I have to examine such a case:
1. create a VMFS-header dump ( thats the first the first 1536 MB of a vmfs-volume) using a command like
cd /dev/disks
ls -lah | grep -v "vml"   # now you can probably identify the devicename by its size and the partition-number
dd if=<device> if=/vmfs/volumes/<other datastore>/<your-name.1536> bs=1M count=1536
next download that file to a host that has grep and strings command
2.run the command
strings your-name.1536 |  grep "# Disk Descriptor" -A 25  >> descriptorfiles.txt
you should now be able to find the descriptorfile of the missing vmdk - check if it was thin provisioned.
By the way - this is also the best procedure to recreate a missing descriptorfile !
Chances:
chances for recovery of deleted or otherwise missing vmdks have changed radically since esxi 5.5.
With 5.5 and later recovering is much trickier than in previous versions.
Good chances: eager zeroed thick provisioned vmdk on a datastore with much free space
Poor chances: thin provisioned vmdk on a datastore which is almost full
Woth thin provisioned vmdk you need readable VMFS-metadata to restore a vmdk. Those metadata is often no longer available after a power failure or accidental delete with 5.5 and later.
With thick provisioned vmdks sometimes it is possible to recover flat.vmdks even when all the VMFS-metadata is gone - it then simply depends on the fragmentation rate.
Useful third party tools:
I have good experience with UFS-explorer, Diskinternals and just recently added ReclaimME Pro.
All other tools I have tried are not worth the download.
And unfortunately none of those 3 tools has a really good UI - so you will

need experience to have good results.

VMware support:
In my experience the chance that support is really helpful is very low - in most cases they dont help with recovery-cases.
Feel free to call me via skype if you want to hear more on this topic

Ulli

[iamamit]

Thanks for the detailed reply.. in addition to this content.. I would like to mention the below KB to help in tracing out the details who deleted the VMDK.. This is the way out I got with the help of VMware support..

http://www.techiessphere.com/2017/03/trace-deleted-virtual-disk-in-vmware.html

Thanks,

Amit