Recover deleted VMDK files

[furkangkhsn]

Some vmdk files was deleted a couple of hours ago. Can i recover that data back?

[continuum]

A couple of hours ago ? - good - the faster you react - the better.
Please read
https://communities.vmware.com/t5/VMware-vSphere-Documents/Create-a-VMFS-Header-dump-using-an-ESXi-Host-in-production/ta-p/2795669
and provide a dump like explained there.
Please include mbr.bin or gpt.bin and tell me what to look for.

Ulli

[continuum]

Here is a short summary of the events that followed this post ....
Furkan send 2 dump-files as he did not remember on which datastore the vmdks were stored.
A short while later I found 2 vmdk-descriptorfiles using strings ....

# Disk DescriptorFile
version=1
encoding="UTF-8"
CID=ec12a068
parentCID=ffffffff
createType="vmfs"
# Extent description
RW 104857600 VMFS "centrallog-flat.vmdk"
# The Disk Data Base
#DDB
ddb.adapterType = "lsilogic"
ddb.geometry.cylinders = "6527"
ddb.geometry.heads = "255"
ddb.geometry.sectors = "63"
ddb.longContentID = "0f37222cfc26388475e79d34ec12a068"
ddb.toolsInstallType = "4"
ddb.toolsVersion = "10346"
ddb.uuid = "60 00 C2 96 d7 4e e5 c7-18 1a fc 3e 43 cd da 81"
ddb.virtualHWVersion = "14"

and

# Disk DescriptorFile
version=1
encoding="UTF-8"
CID=c46c6e3b
parentCID=ffffffff
createType="vmfs"
# Extent description
RW 104857600 VMFS "centrallog_1-flat.vmdk"
# The Disk Data Base
#DDB
ddb.adapterType = "lsilogic"
ddb.geometry.cylinders = "6527"
ddb.geometry.heads = "255"
ddb.geometry.sectors = "63"
ddb.longContentID = "368de53e9a0c7f9f50d46799c46c6e3b"
ddb.uuid = "60 00 C2 97 bb 01 e7 1e-ab 41 6b cc 12 61 5b b4"
ddb.virtualHWVersion = "14"

Both vmdks have a size of 50 GB.

Then a while later I found 2 deleted 50gb objects in the VMFS metadata.
From both locations I extracted 1 MB to check the partitiontables ....

Number Start (sector) End (sector) Size Code Name
1 2048 104857566 50.0 GiB 8E00

and

Number Start (sector) End (sector) Size Code Name
1 2048 4095 1024.0 KiB EF02
2 4096 2101247 1024.0 MiB 8300
3 2101248 104855551 49.0 GiB 8300

Furkan apparently was lucky and his vmdks were thick provisioned and occured in 1 piece.

So I was able to create a dd-commands to extract them.

Ulli

[continuum]

dd-comands to check the partitiontable:

dd if=/dev/disks/naa.600508b1001c42cb968ef634179de1bc:1 bs=1M count=1 skip=2199569 of=50gb-start.bin
dd if=/dev/disks/naa.600508b1001c42cb968ef634179de1bc:1 bs=1M count=1 skip=540689 of=50gb-start-2.bin

Commands to extract the complete 50gbs
dd if=/dev/disks/naa.600508b1001c42cb968ef634179de1bc:1 bs=1M count=51200 skip=2199569 of=50gb-flat.vmdk
dd if=/dev/disks/naa.600508b1001c42cb968ef634179de1bc:1 bs=1M count=51200 skip=540689 of=50gb-2-flat.vmdk

[continuum]

News ....
the 2 vmdks I detected before belong to another VM - one that came without its own directory ...
This means the original dump with size of 2000Mb was too small.
Now we try with 3096MB

 

[Marioadm2013]

Hi Uli,

how did you get the value of the "skip" flag?

we have the a txt file made with strings, of the vmfs that contains a delete vmdk and we don't know how to extract the vmdk, because we can´t get this parameter.

we also contacted you by Skype, you may have an invitation

We wait your reply.

Thanks.

 

[IRIX201110141]

 

Ulli will not respond via Skype or Mail because he passed away a few weeks ago

Regards,
Joerg

[Marioadm2013]

sorry to hear that news. My condolences 

Regards.

[Rohits1208]

If you want to recover corrupt or damaged VMDK files which are damaged due to VMware tools crash, power failure, hard disk crash, virus attack, and more. You can try Cigati VMDK Recovery Tool one of the most prominent utilities to repair corrupt VMDK files on any version of virtual machine VMware.

[continuum]

Can a moderator please remove this shameless advertising link ?
This tool is not worth mentioning

Ulli