I need help bad. - Deleted snapshots

[tek0011]

So.  Human error.  I deleted some snapshots.

Using Workstation 9.

I had roughly 17 snapshots.   I accidentally deleted 5 of the snapshots.   I was able to go back to the original vmdk to get the machine booted, however the data is 4 months old.

Is there any way to recover the data in the other snapshots? 

Edit:  Is it possible to somehow change the CID of the snapshots to match some other parent?  I have very critical information I need.   I cannot use a undelete like Recurva because the vmdks are all encrypted.  Is there another util to use to be able to pull the data off each vmdk?

[WoodyZ]

Just an FYI, while RDPetruska's comments are not in context to what you're trying to do here with dsfo.exe and dsfi.exe so you do not need the information he supplied in this case although it's on target for snapshot merging, that is not what you're doing here.

[WoodyZ]

tek0011 wrote: This is when attempting to hit Go on DSFO.

I know in your next message you said "Nevermind.  DOS prompt worked fine." however what do you mean by "hit Go on DSFO" what were you doing?  dsfo.exe and dsfi.exe are command line utilities!

[tek0011]

There is a GUI version of DSFO inside the zip.

[WoodyZ]

Interesting, I haven't downloaded those files in many years and all I have is command line versions.  I'll have to check it out, thanks!

[tek0011]

So.  Thanks to all of you I have nearly 40% of my data back and working on more.  I have another question however.

I started editing the descriptors and CIDs, and everything is fine until:

So I point vmdks 1,2,3,4,6(pointed back to 4) to each other in order all the way back to the baseline.   They are all happy and I have all their data.  Now, I open 7 and 7 is saying it wants to point to 13.  So I open 13, and 13 wants 12, 12 wants 11, but then 11 wants 1.  Do these snapshots sometimes get based off a different parent than the previous file?  Wouldnt 11 be looking for 10 and not 1? 

What should I do when 7 is looking for 13 and 11 is looking for 1?  Point them to each of those?  Then I would have multiple vmdks being pointed to the same parent (ie, 2 to 1 and then 11 to 1) 

Little confused here.

On a side note I should mention that as I am correcting all these, I have been mounting in PassMark OSFMount, which will only allow read only.  The problem is all my data was on desktop (dumb i know) and you cant navigate in windows to the user folders on a read only mounted vmdk.  So I have been using robocopy to copy all the data out of those directories.   Just an FYI if someone ever ends up doing all this.

[WoodyZ]

Remember earlier I said "This of course assumes a sequential snapshot chain." however Snapshot Chains are not or do not always have to be sequential and one can branch off of a Snapshot or manage the snapshots in such a way that it is not unlikely to see the relationships your are.  At least you're making progress recovering your data and keep you finger off the delete key in the future!

BTW There are other ways to mount the disk to have direct hierarchical access to any location on the disk via a GUI and not have to resort to using a CLI Utility.

[tek0011]

So when it comes to these ones that are not in order.  Do I attempt to put them in order and if that fails point them to the one they are actually looking for and then start the sequence at that point?  I guess Ill see what works here shortly.  I just told 11 to go to 10 instead of 1 and some of the files are corrupt.  So Im going to try and point it to 1, which is what it showed originally for parenthint.

Browsing is nice, however that is a whole other can of worms.  I used over 8 mounting utils and every single time the User directory was locked.  calcs nor gpo's would change it.  Robocopy is working wonders right now.  Especially since I have it scripted to dump each mount to a directory and only overwrite the file if it is newer. 

Thanks again so much for how far you have brought me.  I knew what had to be done, just not how.  Thanks.

[WoodyZ]

I would maintain the expected chain order based on what each Extent is looking for.

I usually get around the locked User Directory by mounting the disk read-only under Unix/Linux as root and get right to what I need.  That said the way your doing it and employing some scripted automation is a good way to approach it too!

[tek0011]

ha.  Ubuntu.  I never thought of going that route.  Great idea. 

[WoodyZ]

I don't specifically use Ubuntu for that, I use OS X if if do it natively, that's the Unix version and if from a VM I usually use Linux Live OS ISO Images based on either Slackware or Debian.  (Yes, I know Ubuntu is a fork of Debian.)

[tek0011]

They all taste the same

[tek0011]

Ok so here is where I am.  Out of 19 snapshots I was able to change the CID's and recover all data up until snapshot 16.  However, when I load anything past 16 I get a "Media Write Protected" and nearly all folders have a size of 0.  Cannot get to the data from Win or Dos.  I could try to mount it and then load some flavor of Linux, but it seems to be there is something more going on with it.  Any ideas?  The last 3 have about 80% of the data I need.

[muddin]

Here is same kind of problems.

[tek0011]

Bump

[tek0011]

I am still stuck on this.  With no luck getting those other 3 vmdks to get out of "Write Protected" mode. 

[continuum]

Can you please attach a vmware.log from a VM start where the disks are flagged as write protected ?

Please check if the vmdk-descriptor files for the 3 readonly snapshots have RW or RDONLY in this line
RW 18432000 SPARSE "test.vmdk"