how to restore data from *-delta.vmdk without *-flat.vmdk ？

[chchang]

due to some reason , I have a abc-00002-delta.vmdk and no other files ( no VMX . no abc-0002-flat.vmdk)

is there any way to mount this vmdk in windows to recover files ？

or any way to mount this vmdk in vsphere ？

I tried to create a new VM and attach the vmdk , there is a error messages

"cannot open the disk '*.vmdk' or one of the snapshot disk is depends on"

[OptimusP]

Sorry, I don't think that's possible. You need the original -flat vmdk file.

[a_p_]

So you only have the delta.vmdk file, i.e. no other .vmdk files?

As you may know, delta files only contain changed blocks/sectors. However, it should be possible to extract at least some data from the snapshot/delta file (the larger the delta file, the larger are chances to recover data).

For this to work you need to know the exact provisioned size of the virtual disk. With this information, create a new virtual disk with this size as an additional virtual disk on a helper VM, and format it the same way as the original disc was formatted (e.g. MBR vs. GPT, Basic disk, ...). Then create the descriptor .vmdk file for the snapshot (settings can derived from the base disk's descriptor .vmdk file's contents). Make sure that "parentCID", and "parentFileNameHint" point to the correct values. Once done, edit the VM's .vmx file, so that it points to the snapshot/delta descriptor .vmdk file, and don't forget to reload the VM after doing this (see Reloading a vmx file without removing the virtual machine from inventory (1026043) | VMware KB). If the VM comes up, you may use a file recovery tool to search for files on the recreated virtual disk.

If you need help, then download the delta.vmdk file to your PC, and use the XLS file which I posted at Corrupt redo log freezing VM​. Note that the Macro may throw an error. However, it should at least create the "Header Definition" tab which contains the important information. If this is the the case, then please attach the resulting XLS file to a reply post.

André

[chchang]

here is the header info

Filename	C:\VM\sql2008-erp-000002-delta.vmdk
Filesize	41,137,819,648
Compatibility	VMware ESX Server
#define COWDISK_MAX_PARENT_FILELEN  1024
#define COWDISK_MAX_NAME_LEN        60
#define COWDISK_MAX_DESC_LEN        512
		Offset	Lenght	Value	Dezimal	Description
typedef struct COWDisk_Header {
unint32	magicNumber;	0	4	44 57 4F 43	COWD	This magic number is used to verify the validity of each sparse extent when the extent is opened
unint32	version;	4	4	00 00 00 01	1	The value of this entry should be 1
unint32	flags;	8	4	00 00 00 03	3	Bit 0: valid new line detection test, bit 1: redundant grain table will be used, bit 16: the grains are compressed
unint32	numSectors;	12	4	05 00 14 E6	83,891,430	Refers to total number of sectors on the base disk.
unint32	grainSize;	16	4	00 00 00 01	1	Refers to the granularity of data stored in delta links, which is one sector by default. Can vary from one sector to 1MB
unint32	gdOffset;	20	4	00 00 00 04	4	Starts at the fourth sector, because the COWDisk_Header structure takes four sectors
unint32	numGDEntries;	24	4	00 00 50 80	20,608	Is CEILING(numSectors, gtCoverage)
unint32	freeSector;	28	4	04 C9 EC AE	80,342,190	Is the next free data sector. This needs to be less than the length of the delta link. It is initially set to gdOffset + numGDSectors
union	{...} u;	32	1028			unused
unint32	generation;	1060	4	00 00 00 00	0
char	name[60];	1064	60			unused
char	description[512];	1124	512			unused
unint32	savedGeneration;	1636	4	00 00 00 00	0	Is used to detect the unclean shutdown of the delta link. It is initially set to 0
char	reserved[8];	1640	8			unused
unint32	uncleanShutdown;	1648	4	00 00 00 00	0	Is used to trigger the metadata consistency check in case there is an abnormal termination of the program
char	padding[396];	1652	396
} COWDisk_Header;

[a_p_ · Accepted solution]

That's an unusual disk size, which is usually a result of a P2V conversion. Anyway, this doesn't matter much, but we will need to create the base virtual disk from the command line.

What's more important is the partition type and the alignment. Unless you know this, I'd suggest you do a first try with an "MBR" partition type, and a "NTFS" formatted "Basic" partition. I'd also suggest you use the default cluster size while formatting the disk, although best practices recommend another cluster size for SQL server.

The good news is that chances to restore files are high due to the size of the delta file, which almost reaches the virtual disk's provisioned size.

Here are the steps:

• enable SSH on the ESXi host, and login via e.g. putty
• go to the folder with the delta file: cd /vmfs/volumes/<datastore-name>/sql2008-erp
• make sure that neither sql2008-erp.vmdk nor sql2008-erp-flat.vmdk already exist!!!
• create a new virtual disk: vmkfstools -c 41945715k  sql2008-erp.vmdk -d thin
• attach the newly created virtual disk to a helper VM, and format it as mentioned above
• shut down the helper VM
• run cat sql2008-erp.vmdk and make note of the "CID" value
• replace the "parentCID" value with the above noted value in the attached sql2008-erp-000002.vmdk file
• upload this file to the VM's folder on the datastore
• edit the helper VM's configuration (.vmx) file, and replace sql2008-erp.vmdk with sql2008-erp-000002.vmdk
• reload the .vmx file as explained in Reloading a vmx file without removing the virtual machine from inventory (1026043) | VMware KB
• create another snapshot to ensure that the data in the delta file doesn't get modified
• power on the VM and check the result

Note:

To edit the attached .vmdk file, either use an editor which can handle unix line breaks, or upload the file first, and then use the vi editor to edit it. If you are going to use WordPad, make sure that you select .txt as the file format when you save the file!!!

André

[chchang]

thanks for reply

But the vm host is disconnect in Vcenter and not able to connect due to some SSL error messages

I will try to reconnect the host and follow your step  if the vm host will be connected .....

[chchang]

my first try , after format the disk with MBR/ntfs/default cluster ,  the rescure VM with the delta disk attached is able to boot , but cant read any files, and in the disk mgmt panel , the disk size is unknown .

so I remove the snapshot , remove the disk (from VM and datastore) , upload again and try dynamic Disk , format as NTFS , reboot , wait for chkdsk to check and fix the disk complete(almost 2 hours) , and all datas come back !

thanks for your help !

[2679]

I have almost the same issue.  Flat.vmdk exist and snapshot file exist.  But unable for vm to boot using delta.vmdk.  I can only boot up using the flat file.

I have no clue on your issue and how you were able to resolve this issue.  I would love to have help in this.

Thanks.

[tungttt23]

Sorry to bother you with this, but can i ask how do you determine the size of the new virtual disk with the -c option when creating the new disk?

"create a new virtual disk: vmkfstools -c 41945715k  sql2008-erp.vmdk -d thin"

I also only have the delta.vmdk file, with no flat.vmdk file, and when i followed your guide it failed to start in the end, putting out an error saying that the disk can't be opened because the capacity of the parent disk and the child disk is different.

Attached is my info using your script.

I would greatly appreciate your help, thanks a lot.

[a_p_]

The "numSectors" represent the virtual disk's provisioned size in sectors (512 Bytes/Sector). You should see the same value in the snapshot's descriptor file. If you divide that value by 2 you'll get the provisioned size in kB.

André

[tungttt23]

Thanks a lot for the explanation, i will try the correct parameter and see if it can recover my data.

Have a nice day.