This is probably one of the worst disasters in a VM environment. One of the VM's was deleted from disk by mistake. Instead of being removed from inventory, the entire folder containing the VMDK was deleted from VMFS.
My intention was to free up some space in the datastore by shrinking some VM's which are no longer in use. It turned out that one of the active one was chosen inadvertently. Here is the steps I have taken during the incident:
1. Shrank all partitions on the VM machines.
2. Ran VM converter to "create" a new VM (V2V) with reduced disk sizes in thin provisioning.
3. Shut down the original VM and delete it from disk.
A few hours later, I realized that the deleted VM actually has a live database. I quickly powered up the shrunk version. While the OS appeared to be operational, drive 😧 and E: (set up as a second HDD) were showing as RAW. Unfortunately, these two partitions contained the database and data files.
I tried some utilities but was unable to convert the RAW drives to NTFS. Is there any way to recover the original VM files? Any chance that I can recover the data?
Esxi Version : 6.5
VM OS: Windows Server 2016
And can we infer from your incident that you have no backups of this VM?
That is correct. That server was just built recently. We were supposed to start backing it up once they are finished with more configuration changes. Sadly we have just started to enter live data to it.
I'm afraid there's no big chance to restore the deleted .vmdk files. in this case
However, try to contact continuum. He's an expert in data recovery. Maybe he's able to help with either a virtual disk recovery, or with extracting data from the secondary virtual disk.
André
Hi Joe
unfortunately you used ESXi 6.5 - recovering deleted VMs is trickier then ever before with 6.5
Anyway - please create a VMFS-header-dump as soon as possible - see
Create a VMFS-Header-dump using an ESXi-Host in production | VM-Sickbay
If we are lucky we will still find the locations of the vmdks and can extract them manually.
If that does not work there is another rather small chance - it only works when the vmdks have been created thick provisioned and were allocated in one piece.
In such a case I can detect the start of the vmdk and extract it with dd.
If you want me to look into your case call me via skype "sanbarrow"
Ulli
You may want to consider using data recovery option as mentioned in below VMware KB article .
If you found this or any other answer helpful, please consider the use of the Correct or Helpful to award points.
Best Regards,
Deepak Koshal
CNE|CLA|CWMA|VCP4|VCP5|CCAH