VMDK file is corrupt. I cannot access files on the disk

[DanCK]

Hi There,

Reaching out for major help here.

I have a VM that had a snapshot. I performed delete all snapshots actions on the disk but canceled it by mistake.

The snapshot files are have disappeared but my drives are not accessible anymore.  I am looking for a silver bullet here that might allow me to recover one drive enough to get to backup files on it.

VM is Windows 2012 server and it has 2 drivers, OS drive and Data drive. I have been googling all day long to find a solution to this problem but just can't seem to find anyone who had a similar issue.

Please could anyone help?

Best Wishes

Dan

[a_p_]

Welcome to the Community,

can you please clarify "The snapshot files are have disappeared ..."? Is this related to whet the Snapshot Manager shows, or to the files located in the VM's folder on the datatsore?

In case the snapshot files in the datastore are still there, then please post a screenshot of the datastore browser window which shows all files with their full names, sizes and time stamps.

André

[DanCK]

Andé, they were both gone from Snapshot manager and from esxi command line when looking at the folder.

I'd like to make a general comment on the interface of vcenter and web client that certain things needs more warning prompts.

Thank you for reply.

[continuum]

If the files disappeared from disk and you need to recover the missing data since the time the snapshot was created you should immediatly create a VMFS header dump and stop any activity on that volume.
To create a header dump find the devicename for the datastore like naa.6*******.
Connect to ESXi with putty and do
cd /dev/disk
dd if=<devicename> of=/tmp/dan.1536 bs=1M count=1536
In case there is not enough free space in tmp - store the dump on another datastore and compress it onb the fly.
Just do that asap.
With the dumpfile I may be able to assist recovering the snapshots.

[DanCK]

Hi Contunuum,

I'm afraid that datastore was being used but 2 other virtual machines and I didn't stop them. I have stopped the original VM pretty much right away. I think it might be too late for that action now?

Also to add, the snapshot was old and needed to be merged. It's the data that was created on the main (you are here) point that has disappeared. Likely due to consolidation not completing properly. I have managed to attached those drives to another VM but when i see all i see are the folder on the drive and as soon as you click them error comes up to say they are not there.

I also managed to copy the vmdk files and using vmdk recovery tool to open them, same result though i can only see the folders but they all say 0 kb in size.

Dan

[continuum]

> I think it might be too late for that action now?
It is never too late for that - that dump can help to completely or partially recover the vmdk content.
If you want - need about an hour to tell you what should be recoverable.
The risk to spoil your chances exists when you are using VMs that change the mapping-table of the vmdks on the fly:  Thin provisioned and VMs with open snapshots.
Thick provisioned VMs dont change their mapping on disk so they can run on.

And do not give up when you see directories that appear empty - Iit usually means that either one fragment is still missing or - if you recover lazy zeroed vmdks you MUST run an extensive checkdisk against the partition.

[DanCK]

Alright! I had another VM Running on that storage. I just powered it down. that VM didn't have much drive expansion and it was THIN partitioned.

The vm that has trouble is the one with THIN partition as well and there is only one drive that i really care for. It contains data and it's about  the Drive is 500GB but the space used is about 800 MB.

The ID of storage is

.naa.6001a620000233353031303030303431

I have space on another storage on /vmfs/volumes/VMFS-id2/

What would the command be?

[DanCK]

HI Ulli,

I sent you a Skype request.

Cheers

Dan

[DanCK]

I've run command dd if=naa.6001a620000233353031303030303431 of=/vmfs/volumes/VMFS-id2/dump/dan.1536 bs=1M count=1536

and it created a 1.5GIG File which I downloaded. What is the next step?

Dan