Recover data from VMware snapshot file

Posted on 2013-08-28
Medium Priority
Last Modified: 2013-09-29
Hey guys,
Question i think i know the answer to my question but want to see any knows a way.
What i have is a large 29GB snapshot file of a VM that is was only 30GB base.
The base VMDK file was accidentally deleted and no backups exist.  
It is a windows 7 VDI desktop,
We would like to try to recover a little bit of data "desktop/Favorites/...."  Is there any way to pull data from the snapshot file?  It has bee around for months and months and months so i would think that it should contain all the newest data that was saved to the desktop and favorites?

If it at all matters it is Windows 7 / ESXI 5.1
Question by:tsukraw
LVL 126
ID: 39445405
If you only have the child (delta) without the parent disk, you could try attaching the snapshot, to a Working Virtual Machine, and see if any data exists.

But I think your chances are very slim, and if absolute desperate, would need the help of Kroll Ontrack.
LVL 28

Expert Comment

ID: 39445557
And just in case you don't know a snapshot really isn't a backup or DR thing. A snapshot is mostly used when you want to make a change to the OS so that if it screws up you can get back to the original system.  Backup programs like VEEAM also use the snapping feature when they are creating their backups.

A snapshot is really a misnomer. You are NOT creating a copy of the VM as it stands now. You are making the VMDK file read-only and then all changes moving forward are being dumped into a Delta file which we call the snapshot file. If you don't remove this as soon as you are done with it it can grow and grow to fill up your HD space and it also make the VM slower as it grows. You can "delete" it in two ways - another bad set of verbiage.  You can actually move a pointer back to the original VMDK file, make it r/w again and then actually delete the delta file which takes the VM back to it's original state. Or you can "delete" it by consolidating the delta file changes into the original vmdk file which keeps the VM in it current state with all changes since you started, and it also deletes the delta file and makes the original vmdk file r/w.

Accepted Solution

dlbenson1979 earned 1000 total points
ID: 39453792
A snapshot only represents the changes (delta) to the information blocks of the original .vmdk. This, infact, is NOT any form of backup or full copy. "Snapshot" is misinterpreted here. Since the snapshot is 29GB, I am assuming that it has been around for a very long time.

Author Closing Comment

ID: 39532018
The data was not recoverable form the snapshot.

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

In this article, I will show you HOW TO: Install VMware Tools for Windows on a VMware Windows virtual machine on a VMware vSphere Hypervisor 6.5 (ESXi 6.5) Host Server, using the VMware Host Client. The virtual machine has Windows Server 2016 instal…
In this article we will learn how to backup a VMware farm using Nakivo Backup & Replication. In this tutorial we will install the software on a Windows 2012 R2 Server.
Teach the user how to use vSphere Update Manager to update the VMware Tools and virtual machine hardware version Open vSphere Client: Review manual processes for updating VMware Tools and virtual hardware versions: Create a new baseline group in vSp…
This Micro Tutorial walks you through using a remote console to access a server and install ESXi 5.1. This example is showing remote access and installation using a Dell server. The hypervisor is the very first component of your virtual infrastructu…

607 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question