Data Recovery from Virtual Machines

Virtual machines offer numerous benefits for both home users and businesses, making it possible to exploit hardware resources more economically while getting the most out of the capabilities of various operating systems: several machines share the same hardware and provide for simultaneous use of different independent OS environments, for instance, Windows and Linux, which in no way hinder the work of the host system. However, such factors as unexpected shutdowns, software malfunctions or human errors may leave the host unaffected but cause serious damage to the virtual machine resulting in data loss from it or simply make the virtual disk it is based on unreadable.

As a rule, virtual disks have the same content as in an ordinary physical drive, which includes logical volumes, file systems, folders and files, however, when recovering data from it, you deal with a file of a special format or its copy instead of physical storage. Such files are usually located in a separate folder under the directory of the corresponding virtual machine. Each of the major virtualization software vendors has its own implementation of a virtual disk: if you have VMware, you most likely should look for a VMDK file, if you use Microsoft's products like Virtual PC or Hyper-V – VHD or VHDX files, and a VDI file in case you employ Oracle's VirtualBox. Still, some virtual disk formats are compatible with other VM products, for instance, VirtualBox is capable of working with VDI, VHD, VMDK and some other types of files.

virtual machine data recovery example

Handle more complicated instances of data loss from virtual machines

Some virtualization products implement specific techniques related to the optimization of virtual disks or their compatibility with the host OS which make data extraction from them much more complicated. Among such technologies are:

Chunked virtual disks were introduced by VMware to create FAT-compatible virtual disks. Since FAT has limitations to the size of files, VMware products support splitting a virtual disk into fragments (chunks) that are no larger than 2 GB each. To read such chunked virtual disks it is required to assemble the chunks into one virtual image. The function is available in UFS Explorer Professional Recovery as a special tool "Disk image of chunk files". This can also be achieved using the "New RAID" tool in UFS Explorer RAID Recovery by assembling "Span of storages" from the chunk files.

Parallels virtual machine's bundles were introduced for Paralles Desktop for Mac, in which a virtual disk is packed into a single file along with its snapshots. To get lost data back from this kind of a virtual disk one must extract it from the VM package first. UFS Explorer Professional Recovery is a helpful solution when it comes to data recovery Parallels VM packages.

ESX Storage is a storage space introduced by VMware for ESX/ESXi hosts which enables them to use a number of physical storage systems to store virtual disks. Such disks can be shared over the network from the server, however, there is a common issue when virtual disk files are shared as blank. To access a file of such a virtual disk, the file should first be transferred from the server to the "local" storage. Also, ESX/ESXi servers employ a special clustered VMFS (VMFS6) file system, which allows running multiple virtual machines in parallel, with concurrent access to their virtual disks. UFS Explorer Professional Recovery is capable of opening ESX/ESXi virtual disks and supports the VMFS (VMFS6) file system, serving as an efficient solution for access to files of such storages as well as data recovery from them.


Looking at a virtual machine file with hexadecimal editor

Explore the presented folders/files and find the ones you are going to copy. You may sort them by various criteria or preview them in the embedded viewer. The process can be also accelerated with the help of the quick search field and the advanced "Find in this folder" search tool.

Data loss from servers, hypervisors, and virtual machines can be daunting. With over 30 years of data recovery experience, Ontrack Australia has recovered data from virtualised systems for thousands of enterprise customers worldwide.

The use of Virtual Machines or Private Clouds has become more popular in today's enterprise world. Virtualization and cloud infrastructure offers a number of advantages in disaster recovery strategy, hardware manipulation and optimization, but it is still vulnerable to data loss caused by a number of internal and external factors.

Placing several machines on a virtualized infrastructure rather than on individual servers creates an increased risk of data loss, as multiple servers may crash together at the same time.

We provide data recovery support for Virtual Platforms including:

  • VMware vSphere ESX and ESXi
  • VMware Infrastructure
  • Microsoft Hyper-V
  • Virtual Desktop Infrastructure
  • Citrix XenSever
  • Oracle VirtualBox

Virtual Data Recovery/VMWare Recovery Systems

Our experts can successfully recover data from nearly any virtual machine, server or system; including:

  • Virtual infrastructure: VMware Infrastructure, VMware vSphere , Virtual Desktop Infrastructure, Microsoft Hyper-V
  • Virtual servers: VMware Server, VMware ESX, Microsoft Hyper-V, Citrix XenServer, Oracle VirtualBox
  • Virtual file systems: VMFS, NTFS, FAT, EXT3, HFS, etc.