Wednesday, July 1, 2015

Recovering data from a VMWare Workstation Snapshot Disk

I was recently working with one of my VMWare Workstation Guest VMs and the OS failed on me.  Since I usually keep my data on a separate VMDK file, I hastily deleted the OS disk and replaced it a brand new one in my template library of virtual machines.

Unfortunately, however, I had created snapshots of that VM and when I attempted to mount the VMDK file containing my data, I suddenly discovered that I could not mount the data that I had stored after I had taken the snapshot.

Fortunately, this VMWare Community forum post pointed me to the root cause of my issue:

The parent chain from the snapshot VMDK file and the base VMDK file was broken.  This could be manually edited using the dsfo.exe and dsfi.exe tools:

Using the commands outlined in the VMWare Community forum, I was able to successfully edit the parent CID for my snapshot VMDK file and mount the virtual disk to be able to recover my data!

Below are the PowerShell scripts I used to accomplish this:
$VMDKFiles = "D:\VMWareVMs\MyData.vmdk", "D:\VMWareVMs\MyData-000002.vmdk"
$dsfoFilePath = "C:\Downloads\VMWare\dsfo.exe"
$BaseDir = "C:\Temp"
foreach ($VMDKFile in $VMDKFiles)
$OutputFileName = Split-Path $VMDKFile -Leaf
$DSFOCmd = @"
""$dsfoFilePath" "$VMDKFile" 0 1536 "$BaseDir\$OutputFileName.txt""
Write-Host $DSFOCmd
& "$dsfoFilePath" "$VMDKFile" 0 1536 "$BaseDir\$OutputFileName.txt"

$dsfiFilePath = "C:\Downloads\VMWare\dsfi.exe"
$VMDKFile = "D:\VMWareVMs\MyData-000002.vmdk"
$BaseDir = "C:\Temp"
$OutputFileName = Split-Path $VMDKFile -Leaf
#dsfi.exe vmname.vmdk 0 1536 modified_file.bin
$DSFICmd = @"
""$dsfiFilePath" "$VMDKFile" 0 1536 "$BaseDir\$OutputFileName.txt""
Write-Host $DSFICmd
& "$dsfiFilePath" "$VMDKFile" 0 1536 "$BaseDir\$OutputFileName.txt"

No comments:

Post a Comment