A failed VM doesn’t have to mean lost data. Explore 5 methods to access and recover the data stored in a VMDK file, using both built-in VMware tools and third-party solutions.
When a virtual machine fails or becomes completely inoperable, retrieving data from its virtual disks, specifically VMware’s Virtual Machine Disk (VMDK) format, becomes a crucial task. However, it is important to note that the methods discussed in this article are effective only when the VMDK file itself is not corrupted or locked. We will explore a variety of techniques and tools designed for extracting data from an intact and accessible VMDK file when the corresponding VM is no longer functional. From VMware’s proprietary tools to third-party utilities and manual extraction techniques, this guide offers step-by-step procedures aimed at IT professionals, system administrators, and data recovery specialists. By mastering these strategies, you can ensure effective data recovery from a dead VM, protecting your organisation’s digital assets under specific conditions of VMDK integrity.
What is VMDK?
Let’s look into the structure of the VMDK file, which comprises two main components: the descriptor and the flat file. In the VMware vSphere’s Datastore browser, these are presented as one unit.
The descriptor is a simple text file that holds parameters like IDs, virtual hardware version, and disk geometry, easily viewed in any text editor. The *flat.vmdk file contains the actual VM data.
When downloading, you’ll be prompted to accept multiple file downloads, showing the real sizes of these files locally.
It’s crucial to note that the extraction methods discussed here only apply when the VMDK file is intact and not locked — this article does not cover recovery from damaged files. The techniques include mounting the VMDK as a read-write volume, which carries risks of data alteration, and safer, read-only methods for data recovery. Always proceed with caution to avoid compromising your data. Let’s explore how to access your VM data using these methods.
So, we have a Windows-based VM, where we have a 10Gb disk formatted with NTFS and have two sample text files inside: ‘test1’ and ‘test2’. Let’s explore how we can extract the data in various ways.
Prerequisites to our methods are the following:
Ensure that the VMDK file is not damaged or locked.
- Verify that you have enough permissions to manage VMs in the ESXi environment.
- Ensure that there is sufficient storage space on the ESXi host/VM to accommodate the VMDK.
Mounting the disk as a read-write volume
- Adding the VMDK to another ESXi VM
Adding a VMDK file to another ESXi VM allows you to access the data from a different virtual environment. This method is useful for data recovery, testing, or migrating data to a new VM. It’s a safer approach compared to mounting as a read-write volume because it isolates the disk within another VM, reducing the risk of accidental data modification on your main system. Here’s how to proceed:
Instructions:
Add VMDK to VM:
- In the VM hardware tab, click ‘Add’ and select ‘Hard Disk’.
- Choose ‘Use an existing virtual disk’ and locate the VMDK file.
Configure Settings:
- Confirm the VMDK file and adjust settings as needed, ensuring it’s not set to ‘Independent’.
Check the newly added disk:
- Recsan the storage
- Bring the disk online
- Check that the VMDK is recognized and accessible.
Data Handling:
- Perform data recovery or migration tasks as needed.
Tips:
- Backup: Always use a copy of the VMDK file to prevent any data loss or corruption.
- Isolate the environment: It’s always better to temporarily disconnect the VM from the network if it is used just for data recovery.
2. Adding the VMDK to another VM in VMware Workstation
Accessing a VMDK file in VMware Workstation is an effective method for securely retrieving data from a virtual machine environment. Whether you’re using VMware Workstation, VMware Player, or VirtualBox, the process is straightforward and ensures that you can manage your virtual disks safely across different platforms.
Create a New Virtual Machine:
- Click on File > New Virtual Machine.
- Select ‘Typical’.
Configure the Operating System:
- Choose ‘I will install the operating system later’.
- Select the operating system.
- Name your virtual machine and choose a storage location.
Add the Existing VMDK File:
- In the ‘Virtual Machine Settings’ window, locate the ‘Hard Disk’ section.
- Select ‘SCSI’ as a Virtual Disk Type.
- Click ‘Add’, then choose ‘Hard Disk’.
- Select ‘Use’ an existing virtual disk.
- Browse to the location of the VMDK file you want to access and select it
- Keep existing format to avoid any data changes.
Power On the VM:
- Click ‘Finish’ to complete the setup and power on the virtual machine.
- Once the VM starts, log into the operating system.
Access and Extract Data:
- Bring the disk online in ‘Disk Management’
- Navigate to the file system within the VM to locate the data in the VMDK file.
Tips:
- Backup: Always use a copy of the VMDK file to prevent any data loss or corruption.
- Shared Folders: Enable shared folders in the VM settings for seamless file transfer between the host and guest systems. This feature is a time-saver when you need to extract only some specific files.
Data recovery methods
-
7-zip tool
Using tools like 7-Zip for data recovery from VMDK files offers a non-intrusive method to extract file contents without the need to mount or alter the disk image. This approach is particularly useful when you want to ensure the integrity of the data within a VMDK file. Here’s a structured guide on how to use 7-Zip for VMDK data recovery:
Prerequisites:
- Download and install 7-Zip, a free and open-source file archiver, from the official website.
- Ensure the VMDK file is accessible and not corrupted.
Instructions:
- Extract the VMDK File contents:
- Right-click on the VMDK file and select 7-Zip > Extract to.
- Extract contents from the ‘1.Basic data partition.ntfs’ file:
This will allow you to view and extract files from the VMDK. Here we have our valid information.
Tips:
- Update: Use the latest 7zip version.
- Monitor for Errors: Watch for issues during extraction.
2. DiskInternals VMFS Recovery
DiskInternals VMFS Recovery is a powerful tool designed to recover lost or damaged data from VMware virtual machine disks and VMFS file systems. It can recover data from corrupt or formatted disks and retrieve deleted files, making it a valuable asset for IT professionals managing VMware environments.
Instructions:
- Launch the Program:
- Open DiskInternals VMFS Recovery >Wizard>Menu> Mount Image
Select the Disk type:
- Choose the VMDK option.
- Select the folder and select the VMDK file to mount:
- Select mapped disk in the Containers and start the recovery by selecting full recovery and the filesystem (NTFS in our case).
- Check the retrieved data:
Tips:
- Backup: Always create a backup of your VMDK files before recovery to avoid data loss.
- Use the Trial Version: Test the trial version to ensure it can recover your data before purchasing the full version.
3. Mounting VMDK on Linux using ibguestfs tool
ibguestfs is a versatile tool for accessing and managing virtual machine disk images. The guestmount option allows you to mount a disk image as a filesystem on your host machine, enabling easy recovery and extraction of files from virtual machines without booting them up.
Instructions:
Install libguestfs:
- sudo apt-get install libguestfs-tools
- Transfer -flat.vmdk and vmdk to the Linux VM. I did that using a shared folder on the network:
- Use virt-filesystems to identify partitions and filesystems on the disk image
virt-filesystems -a /path/disk.vmdk
- Create a directory on your host system where the virtual disk will be mounted
mkdir /mnt/name
- Use guestmount to mount the desired partition from the VMDK file
guestmount -a /path/disk.vmdk -m /dev/sda1 –ro /mnt/name
- Replace /dev/sda1 with the actual partition identified using virt-filesystems.
- Navigate to the mount point to access the files
cd /mnt/name
- Check the retrieved data
Tips:
- Read-Only Mounting: Always use the –ro option to prevent accidental modifications to the disk image. Be cautious when using –rw option, as it allows modifications to the disk image, which could lead to data corruption.
- Verify Kernel Modules: Ensure necessary kernel modules like loop and dm-mod are loaded.
Conclusion
In conclusion, retrieving data from a non-operational VM can be effectively managed using various techniques based on the VMDK file’s condition and your specific needs. Here are the methods we explored:
4. Adding the VMDK to Another ESXi VM: Provides a secure environment for data access with minimal risk of data modification.
5. Adding the Disk in the new VM in VMware Workstation or VirtualBox: Allows for easy access from your desktop, with options for both read-only and read-write mounting.
6. Using Disk Internals VMFS Recovery: A powerful tool for recovering data from damaged or formatted disks.
7. Extracting with 7-Zip: A non-intrusive method ideal for safely extracting files without the risk of altering the disk.
8. Using libguestfs Tool: Enables mounting the VMDK on Linux.
Each method caters to different recovery scenarios, from high-risk modifications to safe, read-only extractions, ensuring effective data recovery and integrity maintenance across diverse situations.
