Deleted parent file, need to recover a file from a snapshot

[ITdownnGa]

One of my guys deleted a vm that had a parent vmdk attached to it.  I only have the snapshot files that were left over, and I need to recover a file from the snapshot.  How can I get the snapshot mounted?  It complains about the parent missing.

[daphnissov]

If the parent VMDK was deleted, there's no way to just "mount a snapshot" as a snapshot is dependent upon its parent. If that parent is gone, the snapshot is useless.

[ITdownnGa]

My sql server backs up to this volume and I thought it would be inside that snapshot.  So I am completely screwed?

[ITdownnGa]

I have a image of that vmdk from the 8th, any way to combine them?

[daphnissov]

Snapshots aren't total copies of the VM or disk, it's a change log between any modifications made to the parent VM or disk from the point at which the snapshot was taken. It's unlikely you can combine a parent disk from weeks ago with a snapshot that was taken much later. There may not be anything you can do at this point unless you've capture the data through some in-guest method prior to deleting the parent disk.

[a_p_]

There are chances to recover files from snapshots (the larger the snapshot, the better are usually the chances). What's basically required is a dummy parent, e.g. a newly created virtual disk (exact same size as the original one). Then one can manually chain the snapshot to the newly created virtual disk by editing the snapshot's "parentCID" in its metadata. Once done, mount the snapshot .vmdk to e.g. a helper VM, and use an in OS tool to search for recoverable files.

André