Avatar of tsukraw
tsukraw asked on

Recover data from VMware snapshot file

Hey guys,
Question i think i know the answer to my question but want to see any knows a way.
What i have is a large 29GB snapshot file of a VM that is was only 30GB base.
The base VMDK file was accidentally deleted and no backups exist.  
It is a windows 7 VDI desktop,
We would like to try to recover a little bit of data "desktop/Favorites/...."  Is there any way to pull data from the snapshot file?  It has bee around for months and months and months so i would think that it should contain all the newest data that was saved to the desktop and favorites?

If it at all matters it is Windows 7 / ESXI 5.1

Avatar of undefined
Last Comment

8/22/2022 - Mon
Andrew Hancock (VMware vExpert PRO / EE Fellow/British Beekeeper)

If you only have the child (delta) without the parent disk, you could try attaching the snapshot, to a Working Virtual Machine, and see if any data exists.

But I think your chances are very slim, and if absolute desperate, would need the help of Kroll Ontrack.

And just in case you don't know a snapshot really isn't a backup or DR thing. A snapshot is mostly used when you want to make a change to the OS so that if it screws up you can get back to the original system.  Backup programs like VEEAM also use the snapping feature when they are creating their backups.

A snapshot is really a misnomer. You are NOT creating a copy of the VM as it stands now. You are making the VMDK file read-only and then all changes moving forward are being dumped into a Delta file which we call the snapshot file. If you don't remove this as soon as you are done with it it can grow and grow to fill up your HD space and it also make the VM slower as it grows. You can "delete" it in two ways - another bad set of verbiage.  You can actually move a pointer back to the original VMDK file, make it r/w again and then actually delete the delta file which takes the VM back to it's original state. Or you can "delete" it by consolidating the delta file changes into the original vmdk file which keeps the VM in it current state with all changes since you started, and it also deletes the delta file and makes the original vmdk file r/w.

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question

The data was not recoverable form the snapshot.
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck