Cheeseman22
Contributor
Contributor

Deleted vmdk files

Jump to solution

We have a VM player hosted on it's own separate drive, That 500gb drive became full and instead of moving some of the vmdk files they were deleted. We still have 000001-000002.vmdk  and 00132.-000174.vdmk files intact with all snapshot files. 

Is there a way to make this VM usable again without the deleted file. We still have 240Gb of files but machine will not start.

0 Kudos
1 Solution

Accepted Solutions
continuum
Immortal
Immortal

It really is a pity that the best VMDK-reading tool is not made by VMware.
Unfortunately this applies to all platforms : ESXi, Workstation and VMplayer

In this case we used an expensive thirdparty tool  and rare knowhow to extract data ....

 

Ulli

Do you need support with a recovery problem ? - send a message via skype "sanbarrow"

View solution in original post

60 Replies
a_p_
Leadership
Leadership

Snapshot files are used as a chain, i.e. each snapshot file in the chain is required to form the virtual disk.
Deleting files in the chain will in almost all cases result in data loss, and/or corruption.

To find out what can be done, as a first step please provide a complete file listing. Due to the number of files in the VM's folder, please run dir *.* /oen > filelist.txt (or ls -lisa > filelist.txt in case of a Linux host), and attach the filelist.txt to your next reply.

André

0 Kudos
Cheeseman22
Contributor
Contributor

Files list attached

0 Kudos
a_p_
Leadership
Leadership

What I need is the listing of all the files in the VM's folder.

André

0 Kudos
Cheeseman22
Contributor
Contributor

Sorry been busy morning and that only makes sense, this should be better.

0 Kudos
a_p_
Leadership
Leadership

I cannot promise you anything, but I'll do my best.

Please extract the attached .zip archive to an empty folder on your PC. The drag&drop the VM's folder onto the .cmd file, or run
Get-VmdkHeader2.cmd H:\PC-70_VM\PC-70.klondike.local

This will extract the header data (no user data) from each .vmdk file, and create Metadata*.bin files.
Once done, compress/zip all the Metadata*.bin files along with the VM's .vmsd file, and its latest vmware.log, and attach the .zip archive to your next reply.

André

0 Kudos
a_p_
Leadership
Leadership

... one more question.

You don't have a backup of the missing/deleted .vmdk files somewhere, do you?

André

0 Kudos
Cheeseman22
Contributor
Contributor

Unfortunately no we do not, this PC is a maintenance PC and is backed up but the H drive was added because the VM was consuming so much space but was overlooked on adding to back ups. It will be added after this!!

0 Kudos
Cheeseman22
Contributor
Contributor

Any luck with a recovery process for this?

0 Kudos
a_p_
Leadership
Leadership

It looks like you've missed my reply with my demand for required data.
Please provide this data, so that I can take a look at it.

André

0 Kudos
Cheeseman22
Contributor
Contributor

sorry my mistake

0 Kudos
a_p_
Leadership
Leadership

This "fix" cannot bring back the missing data from the ~128 deleted snapshot files, but it should repair the snapshot chain, which may help you to access, and backup important data.
I've created an empty stub file, so that you do not need to hex-edit an existing file. Please extract the .vmdk file from the attached .zip archive to the VM's folder.

With the file in place edit the VM's settings, and in Options -> Snapshots -> "When powering off:" set "Take a new snapshot" back to the default "Just power off". This option only creates snapshots, but never deletes them automatically. That's why you ran out of disk space. Once done, take another manual snapshot to preserve the VM's current state!

At this point you may now try to power on the VM to see how the guest file system looks like, and how much data you can extract/backup. If the operating system cannot start, there will be a "Plan B" for how to access the guest data. Let's talk about this later if required.

Depending on the corruption, you may need to start with a new VM to which you can restore the extracted/backed up data. Alternatively, it should be possible to reset the VM to the latest stable state, which however is from 12/09/2020. Again, let's talk about this option later.

If you decide to proceed with the current VM, let me know, so that we can do some housekeeping, i.e. manually consolidate the snapshots.

André

Important: If the VM is highly important, don't try the above mentioned steps. Avoid any changes to the physical disk (the H: drive), but run a data recovery tool to see whether some of the deleted .vmdk file can be recovered!

0 Kudos
DannoB1
Contributor
Contributor

We have sent the drive in for possible recovery but I do not have high hopes for that. I made a complete copy of all files on the old drive and have attached it to the machine running the VM software. I replace the extract the .vmdk file from the attached .zip archive to the VM's folder. When I went to load the drive into VMware I get the attached error that the VMX file is corrupt. I had a copy of the earlier version before crash and swapped out the files with he same result. I attached also.

0 Kudos
a_p_
Leadership
Leadership

The .vmx file contains a line with just the letter "f". I can't tell you where this comes from, but removing this line should solve the issue.

In order for the ESXi host to recognize (re-read) the manual .vmx modification, you may need to reload the VM. For this please follow steps 2 and 3 from https://kb.vmware.com/s/article/1026043.

André

0 Kudos
Cheeseman22
Contributor
Contributor

The VM will start to power up now but gets the BDOD during boot process. Progress is being made. What would be the next steps?

0 Kudos
a_p_
Leadership
Leadership

"Plan B" is to install VMware Workstation Pro on a PC, and use it's "Map virtual Disk" feature, which let's you access the guest filesystem from the host OS. For this to work, the host OS should be the same, or a newer version as the guest OS, or at least be able to handle the guest file system.

Even though that file system is corrupted, you may be able to extract/backup some important files from the VM.

Note: VMware Workstation Pro can be downloaded as a 30 days evaluation, so no need to purchase for that task.

André

0 Kudos
continuum
Immortal
Immortal

For a first impression boot the VM without modifying the vmx-file / or changng the settings via the GUI into a recent LiveCD.

Ulli

Do you need support with a recovery problem ? - send a message via skype "sanbarrow"
0 Kudos
Cheeseman22
Contributor
Contributor

Question, We have located an back up of this VM but it is from Jan 2020. we still are trying to make it boot.. Could we launch this machine and then use the snap shots to bring it up to what was its current version?

0 Kudos
a_p_
Leadership
Leadership

I'm afraid that this won't help, as it's older that what you have.

12/08/2020 02:43 PM 158,268,194,816 PC-70.klondike.local.vmdk
12/09/2020 10:28 AM 15,756,427,264 PC-70.klondike.local-000001.vmdk
12/09/2020 01:57 PM 1,645,608,960 PC-70.klondike.local-000002.vmdk
- missing data/snapshots from 12/09/20 trough 10/05/21
10/05/2021 04:02 PM 1,239,613,440 PC-70.klondike.local-000131.vmdk

What will most likely work is the VM with the two first snapshots, i.e. the state from September 2020.

André

0 Kudos
Cheeseman22
Contributor
Contributor

Yes I can boot to the first 2 snapshots. But now is there any way to access the later snapshots where the required data is found?

Because we are missing 3-131 all that is a void currently. Dumb question can a vmdk file be renamed?

0 Kudos