VMware Communities
Cheeseman22
Contributor
Contributor
Jump to solution

Deleted vmdk files

We have a VM player hosted on it's own separate drive, That 500gb drive became full and instead of moving some of the vmdk files they were deleted. We still have 000001-000002.vmdk  and 00132.-000174.vdmk files intact with all snapshot files. 

Is there a way to make this VM usable again without the deleted file. We still have 240Gb of files but machine will not start.

Reply
0 Kudos
1 Solution

Accepted Solutions
continuum
Immortal
Immortal
Jump to solution

It really is a pity that the best VMDK-reading tool is not made by VMware.
Unfortunately this applies to all platforms : ESXi, Workstation and VMplayer

In this case we used an expensive thirdparty tool  and rare knowhow to extract data ....

 

Ulli


________________________________________________
Do you need support with a VMFS recovery problem ? - send a message via skype "sanbarrow"
I do not support Workstation 16 at this time ...

View solution in original post

60 Replies
a_p_
Leadership
Leadership
Jump to solution

Snapshot files are used as a chain, i.e. each snapshot file in the chain is required to form the virtual disk.
Deleting files in the chain will in almost all cases result in data loss, and/or corruption.

To find out what can be done, as a first step please provide a complete file listing. Due to the number of files in the VM's folder, please run dir *.* /oen > filelist.txt (or ls -lisa > filelist.txt in case of a Linux host), and attach the filelist.txt to your next reply.

André

Reply
0 Kudos
Cheeseman22
Contributor
Contributor
Jump to solution

Files list attached

Reply
0 Kudos
a_p_
Leadership
Leadership
Jump to solution

What I need is the listing of all the files in the VM's folder.

André

Reply
0 Kudos
Cheeseman22
Contributor
Contributor
Jump to solution

Sorry been busy morning and that only makes sense, this should be better.

Reply
0 Kudos
a_p_
Leadership
Leadership
Jump to solution

I cannot promise you anything, but I'll do my best.

Please extract the attached .zip archive to an empty folder on your PC. The drag&drop the VM's folder onto the .cmd file, or run
Get-VmdkHeader2.cmd H:\PC-70_VM\PC-70.klondike.local

This will extract the header data (no user data) from each .vmdk file, and create Metadata*.bin files.
Once done, compress/zip all the Metadata*.bin files along with the VM's .vmsd file, and its latest vmware.log, and attach the .zip archive to your next reply.

André

Reply
0 Kudos
a_p_
Leadership
Leadership
Jump to solution

... one more question.

You don't have a backup of the missing/deleted .vmdk files somewhere, do you?

André

Reply
0 Kudos
Cheeseman22
Contributor
Contributor
Jump to solution

Unfortunately no we do not, this PC is a maintenance PC and is backed up but the H drive was added because the VM was consuming so much space but was overlooked on adding to back ups. It will be added after this!!

Reply
0 Kudos
Cheeseman22
Contributor
Contributor
Jump to solution

Any luck with a recovery process for this?

Reply
0 Kudos
a_p_
Leadership
Leadership
Jump to solution

It looks like you've missed my reply with my demand for required data.
Please provide this data, so that I can take a look at it.

André

Reply
0 Kudos
Cheeseman22
Contributor
Contributor
Jump to solution

sorry my mistake

Reply
0 Kudos
a_p_
Leadership
Leadership
Jump to solution

This "fix" cannot bring back the missing data from the ~128 deleted snapshot files, but it should repair the snapshot chain, which may help you to access, and backup important data.
I've created an empty stub file, so that you do not need to hex-edit an existing file. Please extract the .vmdk file from the attached .zip archive to the VM's folder.

With the file in place edit the VM's settings, and in Options -> Snapshots -> "When powering off:" set "Take a new snapshot" back to the default "Just power off". This option only creates snapshots, but never deletes them automatically. That's why you ran out of disk space. Once done, take another manual snapshot to preserve the VM's current state!

At this point you may now try to power on the VM to see how the guest file system looks like, and how much data you can extract/backup. If the operating system cannot start, there will be a "Plan B" for how to access the guest data. Let's talk about this later if required.

Depending on the corruption, you may need to start with a new VM to which you can restore the extracted/backed up data. Alternatively, it should be possible to reset the VM to the latest stable state, which however is from 12/09/2020. Again, let's talk about this option later.

If you decide to proceed with the current VM, let me know, so that we can do some housekeeping, i.e. manually consolidate the snapshots.

André

Important: If the VM is highly important, don't try the above mentioned steps. Avoid any changes to the physical disk (the H: drive), but run a data recovery tool to see whether some of the deleted .vmdk file can be recovered!

Reply
0 Kudos
DannoB1
Contributor
Contributor
Jump to solution

We have sent the drive in for possible recovery but I do not have high hopes for that. I made a complete copy of all files on the old drive and have attached it to the machine running the VM software. I replace the extract the .vmdk file from the attached .zip archive to the VM's folder. When I went to load the drive into VMware I get the attached error that the VMX file is corrupt. I had a copy of the earlier version before crash and swapped out the files with he same result. I attached also.

Reply
0 Kudos
a_p_
Leadership
Leadership
Jump to solution

The .vmx file contains a line with just the letter "f". I can't tell you where this comes from, but removing this line should solve the issue.

In order for the ESXi host to recognize (re-read) the manual .vmx modification, you may need to reload the VM. For this please follow steps 2 and 3 from https://kb.vmware.com/s/article/1026043.

André

Reply
0 Kudos
Cheeseman22
Contributor
Contributor
Jump to solution

The VM will start to power up now but gets the BDOD during boot process. Progress is being made. What would be the next steps?

Reply
0 Kudos
a_p_
Leadership
Leadership
Jump to solution

"Plan B" is to install VMware Workstation Pro on a PC, and use it's "Map virtual Disk" feature, which let's you access the guest filesystem from the host OS. For this to work, the host OS should be the same, or a newer version as the guest OS, or at least be able to handle the guest file system.

Even though that file system is corrupted, you may be able to extract/backup some important files from the VM.

Note: VMware Workstation Pro can be downloaded as a 30 days evaluation, so no need to purchase for that task.

André

Reply
0 Kudos
continuum
Immortal
Immortal
Jump to solution

For a first impression boot the VM without modifying the vmx-file / or changng the settings via the GUI into a recent LiveCD.

Ulli


________________________________________________
Do you need support with a VMFS recovery problem ? - send a message via skype "sanbarrow"
I do not support Workstation 16 at this time ...

Reply
0 Kudos
Cheeseman22
Contributor
Contributor
Jump to solution

Question, We have located an back up of this VM but it is from Jan 2020. we still are trying to make it boot.. Could we launch this machine and then use the snap shots to bring it up to what was its current version?

Reply
0 Kudos
a_p_
Leadership
Leadership
Jump to solution

I'm afraid that this won't help, as it's older that what you have.

12/08/2020 02:43 PM 158,268,194,816 PC-70.klondike.local.vmdk
12/09/2020 10:28 AM 15,756,427,264 PC-70.klondike.local-000001.vmdk
12/09/2020 01:57 PM 1,645,608,960 PC-70.klondike.local-000002.vmdk
- missing data/snapshots from 12/09/20 trough 10/05/21
10/05/2021 04:02 PM 1,239,613,440 PC-70.klondike.local-000131.vmdk

What will most likely work is the VM with the two first snapshots, i.e. the state from September 2020.

André

Reply
0 Kudos
Cheeseman22
Contributor
Contributor
Jump to solution

Yes I can boot to the first 2 snapshots. But now is there any way to access the later snapshots where the required data is found?

Because we are missing 3-131 all that is a void currently. Dumb question can a vmdk file be renamed?

Reply
0 Kudos