Mounting a local Datastore in a VM

[WarlockArg]

Hi,

      Two weeks ago I deleted a vmdk file from a local datastore in ESXi 6.7. Trying to find a solution to recover the file I found a product from Disk Internals where they say they have a very good ration of success in recovering deleted files.
      I download the product to make a test. The product is installed on Windows (in my case, on a Windows VM). The problem is that in order to read the VMFS (that is mounted and in production) I have to also mount it on the VM as a raw disk. They sent me a procedure where using the vmkfstools I can create a RDM to the local datastore, and afterward adding that vmdk to the Windows VM I should have access to the raw VMFS file system.

      The problem is that when I try to add the rdm file as an existing disk, it gives me an error that says "Incompatible Device Backing Specified for device '0'".

         I think the procedure is very similar to adding a share disk for a MS Cluster, but in this case I would be sharing the physical disk between my VM and the ESXi where the VM is running on. For making the test I also tried to mount another LUN from a iSCSI storage that I have created just for testing before using the real local Datastore. In this last case I presented a new LUN and I created a Datastore on it. The same error appears in both cases, when I try to mount the RDM that points to the Local Datastore and the RDMthat points to the Datastore created on the iSCSI storage. So, I think the problem is not because I'm trying to add a RDM that is mount on the ESXi as local because the same error also occurs with the Datastore that is in the iSCSI storage.
     Thinking about the problem could be because the Datastore I want to access from the VM is mounted on the ESXi, for testing purpose I unmounted the iSCSI Datastore from the ESXi, but again I got the same error message.
     I tried to add the RDM to the VM using a second controller LSI Logical SAS, BusLogic. And I also tried to use the second controller configuring the bus share as physical and virtual. But I always receive the same error message.
     Do you have any idea why I'm getting this error? Or perhaps, someone knows a workaround to mounting a production Datastore to recover the file. The main objective is to recover the deleted vmdk.

Thanks in advance.

Guido.

[continuum]

> The product is installed on Windows (in my case, on a Windows VM).
Ok - it is basically irrelevant wether the Windows is a VM by the way.

> The problem is that in order to read the VMFS (that is mounted and in production) I have to also mount it on the VM as a raw disk.

Why on earth did you do that ???
That is not at all necessary  - normally you connect to the ESXi host via network when you want to recover something from VMFS-volumes.

And normally you would take all precautions to access any VMFS-volumes strictly readonly.

When you delete a VMDK accidentaly from a VMFS-datastore this are the next steps that I would suggest :

1. silence all activity on the datastore - especially try to power off very active thin VMs.

2. create a VMFS-header dump as soon as possible - see Create a VMFS-Header-dump using an ESXi-Host in production | VM-Sickbay

3. pick either the Trial Diskinternals tool or the UFSexplorer trial CD

- if you use Diskinternals use a standalone PC (preferably ) or use a Windows VM (server 2008, win 7 , or server 2012 or 2016)

- follow the Diskinternals Wizard and create a remote connection to your ESXi.

if you use UFSexplorer run it on a ESXi-VM and use UFSexplorer LiveCD.

Watch out - success during first use with the Diskinternals-tool is not the rule in my experience.

Make sure you do not just  run a time-consuming standard signature based scan - search for VMFS volumes !

Anyway - either I miss something or you just believe you need a RDM for recovery - but IMHO you do not need it at all.

Ulli