Solved

Detele accidentaly some file in ESX

Posted on 2014-09-24
33
215 Views
Last Modified: 2016-10-27
Hello Expert,

A friend (he don't sppek english) delete some files in ESX hypervisor with Sphere client. one of this file was  a vmx containig db files for exchange.
He already try to restore with vmfs recovery Tools however the file is unreadable (try to fix with wmmare recovery). do you have any suggestion ?

Thanks by advance
0
Comment
Question by:CalvinGE
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 13
  • 10
  • 9
33 Comments
 
LVL 4

Expert Comment

by:Vishalnarse
ID: 40341015
Hello,

Do you have taken snapshot for those VM,

Please refer the below link for you query...

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1002294

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1023880

If you need any further assistance please let me know.

Thank you
0
 
LVL 121
ID: 40341068
What files have been deleted the the Configuration file VMX can easily be created, or the virtual machine disk ?

If you have removed files from the datastore, they are likely GONE for ever.

However, we've had great success with the following tools

VMFS Recover (free)
http://vmfs-recover.soft112.com/

The following prodyct is very good

UFS Explorer
http://www.ufsexplorer.com/download_pro.php

If you do not have a backup to restore, you will need to consult with an Data Recovery Company such as Kroll Ontrack

http://www.krollontrack.co.uk/
0
 

Author Comment

by:CalvinGE
ID: 40341076
Thanks all for your answer,

Yes Vishalnars,  the there is a snapshoot however is not anymore in the historical of the snapchoot manager

Thank Andrew Hancock, we will try UFS Explorer

Regards
0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 

Author Comment

by:CalvinGE
ID: 40341084
Vishalnars, my friend ask me how to recovery the data from the snapshoot ?
0
 
LVL 4

Expert Comment

by:Vishalnarse
ID: 40341088
thank you for the information. Please try the UFS explorer utility if  you need any further assistance.

Thank you
0
 
LVL 121
ID: 40341095
What file is missing ?

VMX or VMDK ?
0
 

Author Comment

by:CalvinGE
ID: 40341097
Thanks for your answer  Vishalnars, we are cuurently testing with  UFS explorer utility however you juste talk about snapshoot, there is any way to use it to receovers the entire/partial files ?
0
 
LVL 4

Expert Comment

by:Vishalnarse
ID: 40341101
To create a new virtual machine configuration file and point it to the existing .vmdk file:
Log in to the vSphere Client as an administrator.
Right-click the affected virtual machine and click Remove from Inventory.
Right-click an ESXi/ESX host.
Click New Virtual Machine.
Select Custom.
Go through the Create New Virtual Machine wizard until you reach the Select a Disk screen.
Select Use an existing virtual disk and browse to the .vmdk file.
Complete the Create New Virtual Machine wizard.
0
 
LVL 4

Expert Comment

by:Vishalnarse
ID: 40341102
Please try my given URL link which are have provided you.
0
 
LVL 4

Expert Comment

by:Vishalnarse
ID: 40341153
0
 

Author Comment

by:CalvinGE
ID: 40341154
A real big thanks for all of you for your quick reaction on this trouble, Regarding the file delted I reayll don't know, what I'm sure there is a vmdk
0
 
LVL 121
ID: 40341156
Can you screenshot your datastore folder ?
0
 
LVL 4

Expert Comment

by:Vishalnarse
ID: 40341164
You are welcome.

Edited by :

Andrew Hancock
VMware Topic Advisor
0
 

Author Comment

by:CalvinGE
ID: 40341177
Just for your information, this is the error message when we try to open the virtual machine

Reason: The system cannot find the file specified.
Cannot open the disk '/vmfs/volumes/4dc1efbb-485278ec-b036-e83935eb107c/Acronis/Acronis-000009.vmdk' or one of the snapshot disks it depends on.
VMware ESX cannot find the virtual disk "/vmfs/volumes/4dc1efbb-485278ec-b036-e83935eb107c/Acronis/Acronis-000008.vmdk". Verify the path is valid and try again.
0
 
LVL 121
ID: 40341182
looks like a snapshot is missing. was a snapshot file deleted ?

Please upload a screenshot of the VM folder, so we may assist.
0
 

Author Comment

by:CalvinGE
ID: 40341210
Hello, Thanks again, please find attached the datastore viewDatastore Screen
0
 
LVL 121
ID: 40341246
okay the virtual machine has a snapshot, this is the file -00009.vmdk.

can you also check the Disk Settings in the VM ?

Right Click the VM and Edit Settings.
0
 
LVL 4

Expert Comment

by:Vishalnarse
ID: 40341335
Do you have the licence on the ESX vshpere please contact 1800-102-6802 or https://my.vmware.com/web/vmware/login VMware support team.

For issues in the community, send an email to Community_mgr@vmware.com
0
 

Author Comment

by:CalvinGE
ID: 40341341
Hello, first I have a better clear view of the situation,
When I try to add the snapShoot [datastore1] Acronis/Acronis-000009.vmdk  then when we start the virtual machine we have the error with a missing previus snapshoot  Acronis/Acronis-000008.vmdk".
Regarding the disk setting is on my firts screeen shoot of the machine properties.
0
 
LVL 121
ID: 40341359
Your are missing a snapshot.

Could you please check the disk settings ?

It's possible even if we can start this VM, the snapshot chain has been compromised because of the loss of file, and the virtual machine disk will be corrupted.
0
 

Author Comment

by:CalvinGE
ID: 40341369
Well, i think the problem is more complex, i think my friend delete the virtual hard drive file vmdk  and keep only one snapshoot 000009, my point is there any way to recover the lost hard drive ? SnapDisk.JPG
0
 
LVL 4

Expert Comment

by:Vishalnarse
ID: 40341384
Not sure :(
0
 
LVL 121
ID: 40341387
Okay, it's clear that one of more snapshot files could be missing. Because they have been deleted.

1. You could try and recover, to try and undelete the file.

2. otherwise options are to discard the file -0009.vmdk, and all it's data, and try to start the VM, on the parent snapshot file.

This may start the VM, BUT ALL data since the snapshot was initiated and created will be lost.

OR

without the correct chain of parent and child snapshot disks, it's likely the virtual machine disk will be corrupted.

So options:-

1. Restore your virtual machine from a backup.

2. Discard the snapshot file, in hope the VM will start, but data will be lost.

3. VM does not start due to disk corruption.

There is no way of telling in 2 or 3 above without try and testing.
0
 
LVL 4

Expert Comment

by:Vishalnarse
ID: 40341391
Could you please get confirm that this Deleted VM snapshot backup had taken?
You can try to restore it from back up.
0
 
LVL 4

Expert Comment

by:Vishalnarse
ID: 40341404
0
 
LVL 4

Expert Comment

by:Vishalnarse
ID: 40341405
0
 

Author Comment

by:CalvinGE
ID: 40341409
My problem with this situation, is not my client. Then acoring with the local IT of this company there is no backup :-(   This is why I ask if there is any way to recover this file. We already try with NFS recovery Tools but it seems we can view any old files (we try all options)
0
 
LVL 4

Expert Comment

by:Vishalnarse
ID: 40341422
I need to investigate this case and need time as there is no backup for the VM server.

(Is there an opening in your friend office for VMware expert support, I'm looking for it.)
0
 
LVL 121
ID: 40341436
I can guide you through the changes, required, to try and start the VM.

This is a simple change to discard the snapshot.

Let me know if you want to try, by discarding the snapshot.

BUT, the Virtual machine disk, may be junk and corrupted.

The disk has already been damaged because of the deletion.

If you really need the data, call a Diastrer Recovery company Kroll Ontrack to try and recover the vmdk, or use UFS Explorer.
0
 

Author Comment

by:CalvinGE
ID: 40341473
Hello, at this point i think is not possible to find a solution, we already try UFS Explorer and Kroll  on track need more than one week to recover + high cost. I try now to help my friend to manage an alternate solution with his exchange (use ost file and convert to pst) and rebuild an exchange.
0
 
LVL 121

Accepted Solution

by:
Andrew Hancock (VMware vExpert / EE MVE^2) earned 500 total points
ID: 40341479
Hello, at this point i think is not possible to find a solution, we already try UFS Explorer and Kroll  on track need more than one week to recover + high cost. I try now to help my friend to manage an alternate solution with his exchange (use ost file and convert to pst) and rebuild an exchange.

Not quite true...... don't give up!!!! Have FAITH in EE!

This is the procedure should you wish to test this....

it may get you back a Server, which is out of date, but better than nothing, and you have NOTHING TO LOSE!!!!

If you have offline files, even better, because users can then copy their data back....which is missing.....!!!



1. Create a new folder called backup in the VM folder.

2. Cut and Paste the file called Acronis/Acronis-000009.vmdk in the above folder, just in case you need for recovery.

3. Power OFF the VM.

4. Remove the virtual machine disk called Acronis/Acronis-000009.vmdk from the virtual machine, DO NOT DELETE from the datastore. (disk), just remove from virtual machine..

5. Add a new virtual disk back to the virtual machine, browse and select the  Acronis.vmdk

6. If there is no error.

7. Power ON  the VM.

8. Expect Data Loss, because you have discarded the snapshots! (you deleted them!)
0

Featured Post

U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When converting a physical machine to a virtual machine using VMware vCenter Converter Standalone or vCenter Converter Enterprise, if an adapter type is not selected during the initial customization the resulting virtual machine may contain an IDE d…
Ransomware is a growing menace to anyone using a computer or mobile device. Here are answers to some common questions about this vicious new form of malware.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This video shows you how to use a vSphere client to connect to your ESX host as the root user. Demonstrates the basic connection of bypassing certification set up. Demonstrates how to access the traditional view to begin managing your virtual mac…

691 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question