Recover data from VMware snapshot file

Hey guys,
Question i think i know the answer to my question but want to see any knows a way.
What i have is a large 29GB snapshot file of a VM that is was only 30GB base.
The base VMDK file was accidentally deleted and no backups exist.  
It is a windows 7 VDI desktop,
We would like to try to recover a little bit of data "desktop/Favorites/...."  Is there any way to pull data from the snapshot file?  It has bee around for months and months and months so i would think that it should contain all the newest data that was saved to the desktop and favorites?

If it at all matters it is Windows 7 / ESXI 5.1
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
If you only have the child (delta) without the parent disk, you could try attaching the snapshot, to a Working Virtual Machine, and see if any data exists.

But I think your chances are very slim, and if absolute desperate, would need the help of Kroll Ontrack.
And just in case you don't know a snapshot really isn't a backup or DR thing. A snapshot is mostly used when you want to make a change to the OS so that if it screws up you can get back to the original system.  Backup programs like VEEAM also use the snapping feature when they are creating their backups.

A snapshot is really a misnomer. You are NOT creating a copy of the VM as it stands now. You are making the VMDK file read-only and then all changes moving forward are being dumped into a Delta file which we call the snapshot file. If you don't remove this as soon as you are done with it it can grow and grow to fill up your HD space and it also make the VM slower as it grows. You can "delete" it in two ways - another bad set of verbiage.  You can actually move a pointer back to the original VMDK file, make it r/w again and then actually delete the delta file which takes the VM back to it's original state. Or you can "delete" it by consolidating the delta file changes into the original vmdk file which keeps the VM in it current state with all changes since you started, and it also deletes the delta file and makes the original vmdk file r/w.
A snapshot only represents the changes (delta) to the information blocks of the original .vmdk. This, infact, is NOT any form of backup or full copy. "Snapshot" is misinterpreted here. Since the snapshot is 29GB, I am assuming that it has been around for a very long time.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
tsukrawAuthor Commented:
The data was not recoverable form the snapshot.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.