Data Recovery · LanCologne

How can a company regain access to its virtual machines following a corrupted VMware ESXi datastore?

A VMFS datastore manages the virtual hard disks (VMDKs) of the VMs on an ESXi host. If the metadata structure is corrupted, ESXi will no longer display the datastore – although the VMDK data itself may remain largely intact on the storage.

Free enquiry

Technical background

Causes include power cuts, faulty RAID controllers, accidental reformatting or deletion, issues following Updates, and ransomware that encrypts VMDKs directly on the host. Snapshots (delta-VMDKs) and thin provisioning complicate the reconstruction process, as a VM may consist of several files.

What you should – and shouldn’t – do now

  • Do not reformat the datastore or add it again as a new datastore.
  • Do not start snapshot consolidation if the datastore is corrupted.
  • In the event of a ransomware attack on ESXi: isolate the host and back up the logs.

Here’s how we do it

  • Backing up the underlying storage (local disks, RAID or LUN).
  • Analysis of VMFS structures and identification of VMDK descriptors and flat files.
  • Composition of the base disk and snapshot chain.
  • Integration of guest file systems and export of VMs or individual files.

Borders

  • Sections that were overwritten during reformatting are missing.
  • In the case of encrypted VMDKs (ransomware), only the unencrypted parts can be recovered.
  • Incomplete snapshot chains may result in older states.

Possible results

Recovered VMDK files or guest data, and documentation of the reconstructed state.

How we carry out data recovery

Every data storage device is first diagnosed in our own laboratory in Cologne; the diagnosis is free of charge. You will then receive a written quote and can decide whether to accept it. If you decline, you can collect the data storage device from the laboratory by appointment – there are no postage costs involved – or we will post it back to you; in which case postage and packaging costs may apply. Data is recovered from copies, not from the original – using professional data recovery hardware such as the PC-3000. If a drive needs to be opened, this is carried out on a HEPA H14-filtered clean bench. We do not offer a guarantee of success prior to diagnosis, as this is simply not possible in a professional context. Your storage device and your data will remain confidential and will not be passed on to third parties.

1Enquiries and submission by post or in person at the laboratory by prior appointment
2Free diagnosis of the cause of the damage
3Written quotation – we will only proceed once you have approved it; if you decline, you may collect the item from the laboratory or we will return it to you (postage and packaging costs may apply)
4Recovery, data verification and confidential handover

Request a diagnosis   Find out more about the process, costs and confidentiality →

Frequently Asked Questions

Can individual files be recovered from a VM?+
Yes, once the VMDK has been reconstructed, the guest file system can be accessed directly.
What happens to snapshots?+
They are assembled with the base disc, provided the chain is complete.
Is VMware Support helpful?+
For configuration issues, yes. In the case of datastores that are physically or structurally damaged, data recovery must be carried out on copies.

Related topics

🔗 Related topics