It happens to everyone, even the most fastidious of technicians will experience a catastrophic data loss that can, and many times will, cause a loss of revenue within a company. In a virtual environment this can be even more complex as the method for bringing the system(s) online has a more multifaceted underpinning that leads to a dependency upon tools that may or may not be the instrument necessary for recovery. That being said, in the worst of scenarios in a virtual environment the data store or VHD is deleted. This in and of itself is not necessarily a bad thing as you can recover deleted VHD files if handled properly easily through the recycle bin tool. However, because the size of a VHD file is usually rather large the recycle bin is ignored and the file has no real apparent way of recovery. Although data recovery software has a method for recovering deleted files that are no longer in the recycle bin, there are still times, more often than not where even this becomes impossible. In these particular cases the following steps should be followed as this procedure may be your best chance of rebuilding your VHD.
Download VHD Finder:
This software does not depend upon file system indexes, Master File Tables, or any method the needs some remnants of the file system handler. VHD Finder will scan an entire drive looking for VHD meta data markers that will allow for the retrieval and or mounting of your lost VHD. As a precautionary measure make sure not to do any work on the storage medium that houses your deleted VHD.
Scan Data Stream:
Using the simple menu within the software under ‘Functions’ use the ‘Build Stream List’ item. The list box entitled ‘Data Stream’ will be populated with all of the physical devices that the system has access too. To the left of the device ‘Model’ is a small check box. Click on the box of the stream you wish scanned. Go back to the drop down menu ‘Functions’ and choose ‘Begin Stream Scan’. The software will begin its scan and continue to the end of the stream. If VHD Finder locates a VHD file then it will be listed in the list box entitled ‘Found VHDs’. Make note of the Size, Type, and offset of the VHD and use that to identify the proper VHD file for recovery.
Copy Fixed VHD File Segment:
Once you have the offset and the size of a Fixed Size VHD it is a simple matter of marking the sectors necessary for recovery and copying them off onto a different drive in order to try and mount the deleted VHD. Our software Speed Clone For Windows will allow you to image the VHD starting at the marked sector offset and ending at a defined sector. As an example, if the VHD offset is found at sector 1000, and the size of the VHD is 10 GB, then the ending sector for Speed Clone would be (1000 + (10 * 2097152)). The number 2097152 is the amount of sectors per GB. Read the documentation and watch the tutorial videos for Speed Clone before engaging in any use of the product.
Mount Fixed VHD Created File:
Once Speed Clone has created the VHD image, make sure to rename the file with a ‘vhd’ extender. Next, go to disk management and right click on the ‘Disk Management’ item after all of the disks have been populated. You will be presented with a small dialog box that will allow you to browse the active file system and choose the ‘vhd’ file you have just created with Speed Clone. This should mount the VHD and give you access to the data. If however, it does not mount then the following step should be employed.
Recover Fixed VHD Created File:
A Fixed size VHD file is simply a partition with some metadata at the beginning. Using Recover It All Now mount the file as a stream. Scan the stream looking for a valid file system, and once found mount that file system within the software. The software will populate the folder structure and give you access to your data.
In a perfect world these steps will save you every time, however, in this industry there are seldom situations that are perfect. If the VHD is fragmented, if the VHD is Dynamic and not fixed, if the data within the VHD does not give clear access to the file system, etc., etc. Although there are time when these steps may not give you access to your data, they will at least give you a fighting chance.
