Recover Windows file server data from VMDK

A folder was deleted on a Windows Server 2012 Virtual Machine that didn't have any backups.

Deduplication was running on this server. When we ran typical recovery tools (such as easeUS and recuva) we couldn't find the files.

The vmdk that this disk is on is Thin Provisioned.

Is there a way of extracting the deleted data directly from the vmdk.

We are sending to a recovery shop for help, but I wanted to check here first.
anonitAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization ConsultantCommented:
You will need to run recovery tools in the VM OS, to recover the data, and piece the data from the NTFS volume.

The more the VM has been in use the less chance you have got of recovery as the data, will be overwritten as required by the OS, with placement of new files.

It does not matter what datastore type is used.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
anonitAuthor Commented:
Andrew - we already ran recovery tools within the OS. We're trying to extract data from the vmdk layer directly which I thought would be below the OS layer and not susceptible to the same damage from deduplication.
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization ConsultantCommented:
The VMDK is just a file container for the OS volume.

If the Recovery Shop is a specialist in Forensics, otherwise send it to Kroll Ontrack Data Recovery, but as it's a VMDK you could send to lots of vendors, but again if the OS was left to run, the erased data may have been over written, by OS read and writes to the NTFS volume.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2012

From novice to tech pro — start learning today.