Avatar of anonit
anonit
 asked on

Recover Windows file server data from VMDK

A folder was deleted on a Windows Server 2012 Virtual Machine that didn't have any backups.

Deduplication was running on this server. When we ran typical recovery tools (such as easeUS and recuva) we couldn't find the files.

The vmdk that this disk is on is Thin Provisioned.

Is there a way of extracting the deleted data directly from the vmdk.

We are sending to a recovery shop for help, but I wanted to check here first.
Windows Server 2012* recoveryVMwareStorage

Avatar of undefined
Last Comment
Andrew Hancock (VMware vExpert PRO / EE Fellow/British Beekeeper)

8/22/2022 - Mon
ASKER CERTIFIED SOLUTION
Andrew Hancock (VMware vExpert PRO / EE Fellow/British Beekeeper)

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
anonit

ASKER
Andrew - we already ran recovery tools within the OS. We're trying to extract data from the vmdk layer directly which I thought would be below the OS layer and not susceptible to the same damage from deduplication.
Andrew Hancock (VMware vExpert PRO / EE Fellow/British Beekeeper)

The VMDK is just a file container for the OS volume.

If the Recovery Shop is a specialist in Forensics, otherwise send it to Kroll Ontrack Data Recovery, but as it's a VMDK you could send to lots of vendors, but again if the OS was left to run, the erased data may have been over written, by OS read and writes to the NTFS volume.
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23