Recover Snapshoted VMDK file / consolidate a snapshot

[MatanRestart]

Hi,

I have a very huge problem and I don’t know how to deal with it in the right way, i had some old server that been setup with weekly snapshots.

and we some hardware issue with the server that cause to some snapshot files accidentally deleted from datastore.

we be able to recover some of the vmdk files.

picture attached with files that can be find on the server.

we tried few steps to recover the machine (change vmdk on vm configure / create a new snapshot and delete all from snapshot manager)  - i able to turn it on with the flat vmdk, but that data there is a least 6 months ago.

i found some articles  about   consolidate a snapshot and fix snapshot chain but i didnt really understand how to go on with this,

what should i do? Is there any way to merge these files or extract files from them?

[admin]

It really depends on how much data was lost - i.e. what size were the missing delta files. If they were quite small, it might be possible to recover by editing the snapshot chain. This KB details how to do this: https://kb.vmware.com/kb/1007969

So, for example. If you had a VM that had a couple of layers of snapshots - vm.vmdk is the base disk, vm-000001.vmdk is the first snapshot, vm-000002.vmdk is the top level snapshot where writes currently go.

Let's say vm-000001-delta.vmdk gets deleted somehow. Now the VM will not power on because the snapshot chain is broken. The parent snapshot of vm-000002.vmdk is missing.

Sometimes you can fix this by editing the .vmdk descriptor. So you would edit vm-000002.vmdk (NOT the delta file - just the descriptor file). You edit the PID value, and the 'parent file name hint' value within that file. The PID gets changed to the CID of vm.vmdk. And the 'parent file name hint' gets changed to "vm.vmdk". Basicaly we are telling the VM to ignore the missing file - now vm-000002.vmdk no longer considers vm-000001.vmdk to be its parent. It thinks its parent is vm.vmdk.

Like I said, whether this works depends on how much data is missing. You may find the VM powers on but does not boot properly. But, if you are lucky and not much data is missing, this may work.

[a_p_]

Welcome to the Community,

with the snapshot's file sizes there might be a good chance to at least be able to recover some of the important files after re-chaining (and/or cloning) the virtual disk. For this however, it's necessary to rebuild the snapshot chain in the correct order.

Please compress/zip the VM's *.vmx, *.vmsd as well as all the *.vmdk files (those without flat or delta in their names) and attach the resulting .zip archive to a reply post.

Btw. how much free disk space do you have on your datastore(s)?

André

[MatanRestart]

ok so in this case, in need to fix all the chain for example

vm.vmdk parent

vm0001.vmdk

vm0002.vmdk missing

vm0003.vmdk

vm0004.vmdk missing

vm0005.vmdk latest

so new chain for example will be look like that -

vm.vmdk

vm0001.vmdk

vm0003.vmdk

vm0005.vmdk latest

and than i will to run from command line

vmkfstools -i vm0005.vmdk Clone/vmnew.vmdk

?

[a_p_]

Just a quick note. The numbers in the snapshot file's names are not necessarily in an ascending order,. The parentFileNameHint" in the .vmdk files is what matters most!!!

André

[MatanRestart]

Hi thanks for your reply.

i have now something around 300GB free on my data-store.

i will attach files you ask shortly, i will also described what i have done some of them are empty new snapshot that we try to create to solve it, i also edit configuration of the VM so i dont have the original vmx file 😕

i really appreciate all of your help

[MatanRestart]

a.p.‌

i attach the zip file.

just to be sure i add txt file with some notes about the vmdk

once again thanks a lot.

[a_p_ · Accepted solution]

Ok, so from what I found in the files and from the file sizes I reconstructed a possible snapshot chain.

The chain is: 5 -> 4 ->1 -> 14 -> 2 -> 6 -> db1.vmdk

I had to edit two of the .vmdk files (see attachment). The first fix was on No. 14 which pointed to a non-existing snapshot No. 13. The only (next) parent that makes sense here is No. 2, so I chained No. 14 to No. 2. The second fix was to edit the parrentCID in No. 6 to match the base disk's CID. The reason for this mismatch is most likely, because you powered on the VM with db1.vmdk used as the VM's virtual disk.

What I recommend you do now, is to replace the two .vmdk files (12 and 6) with the ones I attached to this post, and then clone the virtual disk from the command line by running vmkfstools -i  db1-000005.vmdk db1-clone.vmdk

The next step is to either attach the newly created clone as an additional virtual disk to a helper VM, or - if you want to see whether the VM is able to boot - attach the db1-clone.vmdk directly to the db1 VM. In the second case, please create a new snapshot prior to powering on the VM with the cloned virtual disk. This way the db1-clone.vmdk will not be modified.

In any case be prepared that there might be corruption in the guest's file system!

André

[mdroapq]

Hi,

im having the same kind of problem and tried to apply the solution but i have a message when i try to clone the vmdk: Failed to open 'vm_3-000077.vmdk': The parent of this virtual disk could not be opened (23).

If anybody could help me please  i would be very thankful.

Thanks in advanced!

Paul

[a_p_]

Welcome to the Community,

issues like this may be similar, but all of them require a detailed understanding of the specific situation.

Please open a new discussion, and provide the required information, i.e. free disk space on the datastore, a list of files (the output of ls -lisa from the command line), the VM's .vmx, .vmsd, vmware*.log, and all the small .vmdk header files. Please compress/zip all the required files and attach them to your new discussion.

In addition to this, please explain what exactly you tried to do so far.

André

[mdroapq]

Hi André and thank you for your quick reply. i will start a new discussion and send the file you ask.

Paul