VMFS file system

[rsh]

Are there any tools to extract the vmdks? I cam see it in hex but how do I retrieve it?
It was an ESXI server and the engineer formated the wrong drive array.

[redseaksa]

Hi
check this link :http://vmetc.com/2008/11/06/vmdk-recovery-tool-available-in-esx-35-update-3/

[rsh]

Unfortunately the volume no longer exists. So we need to extract the files using something like get data back or r-studio but neither will recognize the VMFS structure.

[pbrunnen]

Ew... You could try a different drive (or raid container) with similar characteristics, create a new vmfs, and try using ddrescue with a starting offset right after the partition table definitions.

There is a linux based vmfs filesystem driver that might also be good to try. It has read-only access, but that would be enough in your case. I can't find the link right now, but I know that it is baked into the Clonezilla live CDs.

Hope that helps... I feel your pain!

-Cheers, Peter.

[rsh]

I may give your first suggestion a try. A friend just called and said he had a similar situation. He went with Ontrack and they returned the vmdks on a NTFS drive. So, there has to be tools out there.

[drc]

Most reputable recovery firms are not limited to using openly-/commercially-available software

Sounds like another case of "IT contractor screwed the pooch and is passing on the recovery costs to the client who doesn't know it was the contractor's fault in the first place"... I see a lot of that these days.

[DR-Kiev]

Are there any tools to extract the vmdks? I cam see it in hex but how do I retrieve it?
It was an ESXI server and the engineer formated the wrong drive array.

VMDK file its just image container (without any compression) , its easy to recovery , you need just cut it in winhex (from boot to boot for example) and rename to *.vmdk .


Rarely but it happens that it is "fragmented" , in this situation you need use "virtual translator" in DE for example.

[illizit]

Hi DR-Kiev,

Can you please provide instructions on how to do this? (Cut out the VMDK containers???)

Thanks

[DR-Kiev]

Hi DR-Kiev,

Can you please provide instructions on how to do this? (Cut out the VMDK containers???)

Thanks

Easy:
Find start and press Alt+1, find end press Alt+2,
than press Ctrl+Shift+N

[Doomer]

It is not that easy (usually)
Containers may be fragmented
But the tricky part is that all the changes usually stored separately in update files. And it could be hundreds of them

[icefactory]

Easy:
Find start and press Alt+1, find end press Alt+2,
than press Ctrl+Shift+N

HI

Where is the "start"?
and
Where is the "end"?

I hope.. show me details. Please

Thanks you.

# Disk DescriptorFile
version=1
encoding="UTF-8"
CID=f2161662
parentCID=ffffffff
isNativeSnapshot="no"
createType="vmfs"

# Extent description
RW 3904125272 VMFS "vmware_1-flat.vmdk"

# The Disk Data Base
#DDB

ddb.adapterType = "lsilogic"
ddb.geometry.sectors = "63"
ddb.geometry.heads = "255"
ddb.geometry.cylinders = "243020"
ddb.uuid = "60 00 C2 93 93 38 42 5b-19 f5 6e ba a8 cc 90 2c"
ddb.longContentID = "cc2c415bd42ce3a0d46e2b1ff2161662"
ddb.virtualHWVersion = "8"

Last edited by icefactory on February 7th, 2012, 12:40, edited 1 time in total.

[hddguy]

You can find the start of the container by the first sector of the container, or even the start of the file system within the container. The end of container you can figure out based on the partition properties of the start of the file-system.