Approximately 24 hours ago, an engineer was working on an ESX4.1 server. The engineer was tasked with shutting down the guest and making a copy of the relevant directories onto a separate network drive. This was intended to be a form of backup. The infrastructure was only recently inherited, and the previous managers had done very little in the way of backups.
Unfortunately, the engineer hit delete from the the datastore browser instead of download then confirmed it. The mistake was realised after the fact.
our infrastructure consists of two ESX4.1 servers, both with local storage. The guests concerned are on ESX1. The VCentre guest is on the same device. VCentre is the only server we currently have access to.
there's nothing on the other esx server.
We've tried diskinternal's vmfs-recover however if i use the remote-esx option and browsed the datastore, we don't see the folder or any option to undelete. I don't see an option to mount the physical ESX disk remotely. I suspect this could be because the VMFS volumes are in use - would that be an accurate suggestion? If we shut down and dismounted the datastores, would vmfs-recover then see the volumes?
I haven't yet tried a live-cd with vmfsfuse - this would require that we shut down all the guests to be able to mount the volume.
my next step is to try the following:
- startup a guest on the second ESX server (no risk to the vmfs on esx1)
- run disk internals on this
- ensure remote access via logmein or teamviewer
- shut down the other guests on esx1
- manage ESX1 directly using vsphere cilent, not vcenter.
The next step after that would be to attempt vmfs-fuse with a linux liveCD to see if the files are there.
These were thick-provisioned VMDK files.there's no other damage to the VMFS.
I guess our next step would then be Kroll Ontrack ?