Any way to save an encrypted VM...

[John Marinuzzi]

My computer was experiencing connection issues and had to be re-imaged.  Being the experienced computer guy that I am, I backed everything up, ready to roll when it was cleared up and working again.  However, being not so smart, I either did not remember or realize that the virtual machine was encrypted. Now, I can no longer access the VM because I do not know/remember the password to decrypt it.  Are there any means of getting my data back?  I had a lot of unsaved work on that VM.

Thank you,

John

[Technogeezer]

I don't think the encrypted entries in the .vmx file are going to be much use to you without the key.

But, it does look like your VMDK may be unencrypted.

Try creating a new VM, but use an existing virtual disk instead of a new one. Then locate the .vmdk "descriptor" file of the old VM and ask Workstation to make a copy of it in the new VM. 

[Technogeezer]

What version of Workstation are you using, how did you encrypt the VM, and how did you recover what you'd backed up?  

If you used Workstation 16.2's experimental vTPM, it's not going to be easy. If you used 17's partial encryption we may have better luck. If it's full encryption, you're out of luck.

[John Marinuzzi]

Thank you for the reply. I used 17.5 Workstation.  I don't remember many of the details about the setup on the VM, though.  I don't even remember the size I made it. I did buy a 1TB hard drive to house it, but pretty sure I did not use the whole thing (for size setup). I certainly don't remember setting up encryption. I have looked through the web and saw the dsfi/dsfo technique, but since it was setup as multiple files for the hard drive, that technique seems impossible.

John

[Technogeezer]

Workstation doesn't automatically encrypt VMs - except in one case. If the VM is created as Windows 11 guest operating system type on Workstation 17.x, encryption will be enabled VM because of the use of the virtual TPM device. Even then, you're asked to select the encryption type. You're then asked to provide a password or have one automatically generated. You also would have the ability for Workstation to 'remember' the password - for a Windows host, that means it stores the password in the Windows Credential Manager. 

If your re-image has recovered the Windows Credential Manager, you might want to see if the password is in there. 

Is the .vmx file readable to the human eye - that is, is it unencrypted? If so, that means that the VM was encrypted with partial encryption and you may be able to recover the VM by creating a new custom VM of the same type and use the virtual disks of the original VM (as it should be unencrypted).

[John Marinuzzi]

The .vmx file is readable ASCII.  In fact, there are a few keys like encryption.encrytedKey that looked promising to me. I was truly hoping the Windows Credential Manager was cloud-based (like LastPass, etc.), but that does not seem to be the case. I did go looking for it. In the end, the company actually ended up getting me a new computer, so I don't even have access to that system anymore.  We tried to re-image the old computer first, and the initial problem persisted, which is why they swapped it out. I was kind of hoping that some combination of the keys in that .ini file could be used to backtrack the password.

[John Marinuzzi]

There are 43 .vmdk files ranging in size from 2048 KB to 24579008 KB.

[John Marinuzzi]

Great!  Thank you.  I will try that. But can you clarify what "existing virtual disk" and ".vmdk descriptor" mean exactly?

John

[Technogeezer]

If you post a list of the files in the VMs folder I can point you to the right one. 

[John Marinuzzi]

Thank you! Here they are:

        75,802 mksSandbox-1.log
        75,804 mksSandbox-2.log
 6,500,355,735 Virtual Machines.7z
     9,423,664 vmmcores-1.gz
    28,407,058 vmmcores-2.gz
       323,422 vmware-1.log
       392,365 vmware-2.log
    16,188,596 vmware-vmx-0.dmp
    16,220,865 vmware-vmx.dmp
       326,460 vmware-0.log
         8,192 Windows 11-1.scoreboard
         8,192 Windows 11-2.scoreboard
         8,192 Windows 11-3.scoreboard
         8,192 Windows 11-4.scoreboard
         8,192 Windows 11-5.scoreboard
   936,611,840 Windows 11-5610f7cf.vmem
     1,183,744 Windows 11-5610f7cf.vmss
16,670,130,176 Windows 11-s001.vmdk
16,773,152,768 Windows 11-s002.vmdk
16,777,281,536 Windows 11-s003.vmdk
16,779,313,152 Windows 11-s004.vmdk
16,700,080,128 Windows 11-s005.vmdk
16,776,232,960 Windows 11-s006.vmdk
16,774,987,776 Windows 11-s007.vmdk
16,777,543,680 Windows 11-s008.vmdk
16,776,364,032 Windows 11-s009.vmdk
16,764,174,336 Windows 11-s010.vmdk
16,774,922,240 Windows 11-s011.vmdk
16,746,741,760 Windows 11-s012.vmdk
16,760,373,248 Windows 11-s013.vmdk
16,778,526,720 Windows 11-s014.vmdk
16,778,723,328 Windows 11-s015.vmdk
16,779,313,152 Windows 11-s016.vmdk
16,775,184,384 Windows 11-s017.vmdk
16,778,985,472 Windows 11-s018.vmdk
16,769,417,216 Windows 11-s019.vmdk
 3,996,516,352 Windows 11-s020.vmdk
     2,097,152 Windows 11-s021.vmdk
     2,097,152 Windows 11-s022.vmdk
     2,097,152 Windows 11-s023.vmdk
     2,097,152 Windows 11-s024.vmdk
     2,097,152 Windows 11-s025.vmdk
     2,097,152 Windows 11-s026.vmdk
     2,097,152 Windows 11-s027.vmdk
     2,097,152 Windows 11-s028.vmdk
     2,097,152 Windows 11-s029.vmdk
     2,097,152 Windows 11-s030.vmdk
     2,097,152 Windows 11-s031.vmdk
   807,600,128 Windows 11-s032.vmdk
25,168,904,192 Windows 11-s033.vmdk
 7,167,410,176 Windows 11-s034.vmdk
     3,080,192 Windows 11-s035.vmdk
     3,080,192 Windows 11-s036.vmdk
     3,080,192 Windows 11-s037.vmdk
     3,080,192 Windows 11-s038.vmdk
     3,080,192 Windows 11-s039.vmdk
     3,080,192 Windows 11-s040.vmdk
     3,080,192 Windows 11-s041.vmdk
     3,080,192 Windows 11-s042.vmdk
   835,911,680 Windows 11-s043.vmdk
     2,408,448 Windows 11.nvram
         8,192 Windows 11-0.scoreboard
            77 Windows 11.vmsd
         4,103 Windows 11.vmxf
       322,296 vmware.log
         8,192 Windows 11.scoreboard
        76,697 mksSandbox-0.log
        76,697 mksSandbox.log
         2,615 Windows 11.vmdk
        11,241 Windows 11.vmx

[Technogeezer]

You want the file Windows 11.vmdk. That’s the descriptor file for the virtual disk. All the other Windows 11-s*.vmdk files are the slices of the disk since you in all likelihood chose to split the virtual disk into multiple files when you created the VM. 

[John Marinuzzi]

It is saved!  Thank you! Thank you! Thank you!  The steps were a little different but along the same line.  What I did was create a new VM with the same name and disk setup (split disks, expanding).  For some reason, the descriptor file on the new one was readable, but the number of disks listed in the file did not match.  I edited the descriptor file to have the same number of disks as the old VM, booted it up, and it worked.  It asked me to reset my PIN and sign in to Windows again.  But it is booted, and I am copying my files over to a safe place now. I owe you a case of your favorite b-e-e-r :-)

One odd thing I notice about the VM now, though, it is that is slow AF.  When I was running this with a Windows 10 host, it ran smoothly.  On a Windows 11 host, it drags badly. I wonder why.

John