Solved

Detele accidentaly some file in ESX

Posted on 2014-09-24
33
198 Views
Last Modified: 2016-10-27
Hello Expert,

A friend (he don't sppek english) delete some files in ESX hypervisor with Sphere client. one of this file was  a vmx containig db files for exchange.
He already try to restore with vmfs recovery Tools however the file is unreadable (try to fix with wmmare recovery). do you have any suggestion ?

Thanks by advance
0
Comment
Question by:CalvinGE
  • 13
  • 10
  • 9
33 Comments
 
LVL 4

Expert Comment

by:Vishalnarse
Comment Utility
Hello,

Do you have taken snapshot for those VM,

Please refer the below link for you query...

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1002294

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1023880

If you need any further assistance please let me know.

Thank you
0
 
LVL 117

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE)
Comment Utility
What files have been deleted the the Configuration file VMX can easily be created, or the virtual machine disk ?

If you have removed files from the datastore, they are likely GONE for ever.

However, we've had great success with the following tools

VMFS Recover (free)
http://vmfs-recover.soft112.com/

The following prodyct is very good

UFS Explorer
http://www.ufsexplorer.com/download_pro.php

If you do not have a backup to restore, you will need to consult with an Data Recovery Company such as Kroll Ontrack

http://www.krollontrack.co.uk/
0
 

Author Comment

by:CalvinGE
Comment Utility
Thanks all for your answer,

Yes Vishalnars,  the there is a snapshoot however is not anymore in the historical of the snapchoot manager

Thank Andrew Hancock, we will try UFS Explorer

Regards
0
 

Author Comment

by:CalvinGE
Comment Utility
Vishalnars, my friend ask me how to recovery the data from the snapshoot ?
0
 
LVL 4

Expert Comment

by:Vishalnarse
Comment Utility
thank you for the information. Please try the UFS explorer utility if  you need any further assistance.

Thank you
0
 
LVL 117

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE)
Comment Utility
What file is missing ?

VMX or VMDK ?
0
 

Author Comment

by:CalvinGE
Comment Utility
Thanks for your answer  Vishalnars, we are cuurently testing with  UFS explorer utility however you juste talk about snapshoot, there is any way to use it to receovers the entire/partial files ?
0
 
LVL 4

Expert Comment

by:Vishalnarse
Comment Utility
To create a new virtual machine configuration file and point it to the existing .vmdk file:
Log in to the vSphere Client as an administrator.
Right-click the affected virtual machine and click Remove from Inventory.
Right-click an ESXi/ESX host.
Click New Virtual Machine.
Select Custom.
Go through the Create New Virtual Machine wizard until you reach the Select a Disk screen.
Select Use an existing virtual disk and browse to the .vmdk file.
Complete the Create New Virtual Machine wizard.
0
 
LVL 4

Expert Comment

by:Vishalnarse
Comment Utility
Please try my given URL link which are have provided you.
0
 
LVL 4

Expert Comment

by:Vishalnarse
Comment Utility
0
 

Author Comment

by:CalvinGE
Comment Utility
A real big thanks for all of you for your quick reaction on this trouble, Regarding the file delted I reayll don't know, what I'm sure there is a vmdk
0
 
LVL 117

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE)
Comment Utility
Can you screenshot your datastore folder ?
0
 
LVL 4

Expert Comment

by:Vishalnarse
Comment Utility
You are welcome.

Edited by :

Andrew Hancock
VMware Topic Advisor
0
 

Author Comment

by:CalvinGE
Comment Utility
Just for your information, this is the error message when we try to open the virtual machine

Reason: The system cannot find the file specified.
Cannot open the disk '/vmfs/volumes/4dc1efbb-485278ec-b036-e83935eb107c/Acronis/Acronis-000009.vmdk' or one of the snapshot disks it depends on.
VMware ESX cannot find the virtual disk "/vmfs/volumes/4dc1efbb-485278ec-b036-e83935eb107c/Acronis/Acronis-000008.vmdk". Verify the path is valid and try again.
0
 
LVL 117

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE)
Comment Utility
looks like a snapshot is missing. was a snapshot file deleted ?

Please upload a screenshot of the VM folder, so we may assist.
0
 

Author Comment

by:CalvinGE
Comment Utility
Hello, Thanks again, please find attached the datastore viewDatastore Screen
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 117

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE)
Comment Utility
okay the virtual machine has a snapshot, this is the file -00009.vmdk.

can you also check the Disk Settings in the VM ?

Right Click the VM and Edit Settings.
0
 
LVL 4

Expert Comment

by:Vishalnarse
Comment Utility
Do you have the licence on the ESX vshpere please contact 1800-102-6802 or https://my.vmware.com/web/vmware/login VMware support team.

For issues in the community, send an email to Community_mgr@vmware.com
0
 

Author Comment

by:CalvinGE
Comment Utility
Hello, first I have a better clear view of the situation,
When I try to add the snapShoot [datastore1] Acronis/Acronis-000009.vmdk  then when we start the virtual machine we have the error with a missing previus snapshoot  Acronis/Acronis-000008.vmdk".
Regarding the disk setting is on my firts screeen shoot of the machine properties.
0
 
LVL 117

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE)
Comment Utility
Your are missing a snapshot.

Could you please check the disk settings ?

It's possible even if we can start this VM, the snapshot chain has been compromised because of the loss of file, and the virtual machine disk will be corrupted.
0
 

Author Comment

by:CalvinGE
Comment Utility
Well, i think the problem is more complex, i think my friend delete the virtual hard drive file vmdk  and keep only one snapshoot 000009, my point is there any way to recover the lost hard drive ? SnapDisk.JPG
0
 
LVL 4

Expert Comment

by:Vishalnarse
Comment Utility
Not sure :(
0
 
LVL 117

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE)
Comment Utility
Okay, it's clear that one of more snapshot files could be missing. Because they have been deleted.

1. You could try and recover, to try and undelete the file.

2. otherwise options are to discard the file -0009.vmdk, and all it's data, and try to start the VM, on the parent snapshot file.

This may start the VM, BUT ALL data since the snapshot was initiated and created will be lost.

OR

without the correct chain of parent and child snapshot disks, it's likely the virtual machine disk will be corrupted.

So options:-

1. Restore your virtual machine from a backup.

2. Discard the snapshot file, in hope the VM will start, but data will be lost.

3. VM does not start due to disk corruption.

There is no way of telling in 2 or 3 above without try and testing.
0
 
LVL 4

Expert Comment

by:Vishalnarse
Comment Utility
Could you please get confirm that this Deleted VM snapshot backup had taken?
You can try to restore it from back up.
0
 
LVL 4

Expert Comment

by:Vishalnarse
Comment Utility
0
 
LVL 4

Expert Comment

by:Vishalnarse
Comment Utility
0
 

Author Comment

by:CalvinGE
Comment Utility
My problem with this situation, is not my client. Then acoring with the local IT of this company there is no backup :-(   This is why I ask if there is any way to recover this file. We already try with NFS recovery Tools but it seems we can view any old files (we try all options)
0
 
LVL 4

Expert Comment

by:Vishalnarse
Comment Utility
I need to investigate this case and need time as there is no backup for the VM server.

(Is there an opening in your friend office for VMware expert support, I'm looking for it.)
0
 
LVL 4

Expert Comment

by:Vishalnarse
Comment Utility
0
 
LVL 117

Expert Comment

by:Andrew Hancock (VMware vExpert / EE MVE)
Comment Utility
I can guide you through the changes, required, to try and start the VM.

This is a simple change to discard the snapshot.

Let me know if you want to try, by discarding the snapshot.

BUT, the Virtual machine disk, may be junk and corrupted.

The disk has already been damaged because of the deletion.

If you really need the data, call a Diastrer Recovery company Kroll Ontrack to try and recover the vmdk, or use UFS Explorer.
0
 

Author Comment

by:CalvinGE
Comment Utility
Hello, at this point i think is not possible to find a solution, we already try UFS Explorer and Kroll  on track need more than one week to recover + high cost. I try now to help my friend to manage an alternate solution with his exchange (use ost file and convert to pst) and rebuild an exchange.
0
 
LVL 117

Accepted Solution

by:
Andrew Hancock (VMware vExpert / EE MVE) earned 500 total points
Comment Utility
Hello, at this point i think is not possible to find a solution, we already try UFS Explorer and Kroll  on track need more than one week to recover + high cost. I try now to help my friend to manage an alternate solution with his exchange (use ost file and convert to pst) and rebuild an exchange.

Not quite true...... don't give up!!!! Have FAITH in EE!

This is the procedure should you wish to test this....

it may get you back a Server, which is out of date, but better than nothing, and you have NOTHING TO LOSE!!!!

If you have offline files, even better, because users can then copy their data back....which is missing.....!!!



1. Create a new folder called backup in the VM folder.

2. Cut and Paste the file called Acronis/Acronis-000009.vmdk in the above folder, just in case you need for recovery.

3. Power OFF the VM.

4. Remove the virtual machine disk called Acronis/Acronis-000009.vmdk from the virtual machine, DO NOT DELETE from the datastore. (disk), just remove from virtual machine..

5. Add a new virtual disk back to the virtual machine, browse and select the  Acronis.vmdk

6. If there is no error.

7. Power ON  the VM.

8. Expect Data Loss, because you have discarded the snapshots! (you deleted them!)
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

Suggested Solutions

#Citrix #Citrix Netscaler #HTTP Compression #Load Balance
It Is not possible to enable LLDP in vSwitch(at least is not supported by VMware), so in this article we will enable this, and also go trough how to enabled CDP and how to get this information in vSwitches and also in vDS.
Teach the user how to install and configure the vCenter Orchestrator virtual appliance Open vSphere Web Client: Deploy vCenter Orchestrator virtual appliance OVA file: Verify vCenter Orchestrator virtual appliance boots successfully: Connect to the …
How to install and configure Citrix XenApp 6.5 - Part 1. In this video tutorial we have explained step by step installation of Citrix XenApp 6.5 Server on Windows Server 2008 R2 is explained in this video. We have explained the difference between…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now