Link to home
Start Free TrialLog in
Avatar of tsukraw

asked on

Recover data from VMware snapshot file

Hey guys,
Question i think i know the answer to my question but want to see any knows a way.
What i have is a large 29GB snapshot file of a VM that is was only 30GB base.
The base VMDK file was accidentally deleted and no backups exist.  
It is a windows 7 VDI desktop,
We would like to try to recover a little bit of data "desktop/Favorites/...."  Is there any way to pull data from the snapshot file?  It has bee around for months and months and months so i would think that it should contain all the newest data that was saved to the desktop and favorites?

If it at all matters it is Windows 7 / ESXI 5.1
Avatar of Andrew Hancock (VMware vExpert PRO / EE Fellow/British Beekeeper)
Andrew Hancock (VMware vExpert PRO / EE Fellow/British Beekeeper)
Flag of United Kingdom of Great Britain and Northern Ireland image

If you only have the child (delta) without the parent disk, you could try attaching the snapshot, to a Working Virtual Machine, and see if any data exists.

But I think your chances are very slim, and if absolute desperate, would need the help of Kroll Ontrack.
And just in case you don't know a snapshot really isn't a backup or DR thing. A snapshot is mostly used when you want to make a change to the OS so that if it screws up you can get back to the original system.  Backup programs like VEEAM also use the snapping feature when they are creating their backups.

A snapshot is really a misnomer. You are NOT creating a copy of the VM as it stands now. You are making the VMDK file read-only and then all changes moving forward are being dumped into a Delta file which we call the snapshot file. If you don't remove this as soon as you are done with it it can grow and grow to fill up your HD space and it also make the VM slower as it grows. You can "delete" it in two ways - another bad set of verbiage.  You can actually move a pointer back to the original VMDK file, make it r/w again and then actually delete the delta file which takes the VM back to it's original state. Or you can "delete" it by consolidating the delta file changes into the original vmdk file which keeps the VM in it current state with all changes since you started, and it also deletes the delta file and makes the original vmdk file r/w.
Avatar of dlbenson1979
Flag of United States of America image

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of tsukraw


The data was not recoverable form the snapshot.