How can one recover data from a virtual machine?
Virtual machines offer numerous benefits for both home users and businesses, making it possible to exploit hardware resources more economically while getting the most out of the capabilities of various operating systems: several machines share the same hardware and provide for simultaneous use of different independent OS environments, for instance, Windows and Linux, which in no way hinder the work of the host system. However, such factors as unexpected shutdowns, software malfunctions or human errors may leave the host unaffected but cause serious damage to the virtual machine resulting in data loss from it or simply make the virtual disk it is based on unreadable.
As a rule, virtual disks have the same content as in an ordinary physical drive, which includes logical volumes, file systems, folders and files, however, when recovering data from it, you deal with a file of a special format or its copy instead of physical storage. Such files are usually located in a separate folder under the directory of the corresponding virtual machine. Each of the major virtualization software vendors has its own implementation of a virtual disk: if you have VMware, you most likely should look for a VMDK file, if you use Microsoft's products like Virtual PC or Hyper-V – VHD or VHDX files, and a VDI file in case you employ Oracle's VirtualBox. Still, some virtual disk formats are compatible with other VM products, for instance, VirtualBox is capable of working with VDI, VHD, VMDK and some other types of files.
Hint: More information about virtual machnies and their peculiarities can be found in the corresponding article. In case of simple inaccessibility of files stored on a virtual disk, please refer to data access on virtual machines.
Open and restore files from a virtual disk of VMware, Hyper-V, VirtualBox, QEMU, XEN
SysDev Laboratories offers UFS Explorer and Recovery Explorer products which support the most common virtual disks formats, including both sparse and flat VMDK, and will efficiently manage data recovery from a virtual layer of the host system.
To carry out the procedure using UFS Explorer Standard Recovery, take the following steps:
Note: Recovery of lost files is possible as long as they are not overwritten with some other information. For this reason, it is highly recommended to power off the virtual machine and avoid using it until data recovery is completed. Running the virtual machine you risk causing more damage to the corrupted logical structures or even irreversibly destroying the data.
Download and install UFS Explorer Standard Recovery. See to it that the downloaded version of the software corresponds to the operating system it will be run on.
Hint: If you have any difficulties with the installation of the utility, please refer to the installation manual for UFS Explorer Standard Recovery.
Launch the program and modify its parameters, if it is necessary.
To mount your virtual disk in the software, choose the "Open" tool from the main menu and click "Image file or virtual disk". Navigate to the file which represents your virtual storage.
Find and select the mounted disk in the left pane of the main window and scan it for lost data using the corresponding storage context menu option, the "Start scan" button or the "Scan this storage" tool from the toolbar.
Explore the presented folders/files and find the ones you are going to copy. You may sort them by various criteria or preview them in the embedded viewer. The process can be also accelerated with the help of the quick search field and the advanced "Find in this folder" search tool.
Click "Define selection" and choose all files/folders you are going to recover.
Copy the selected files to the host system or any external storage using the "Save current selection" tool.
Handle more complicated instances of data loss from virtual machines
Some virtualization products implement specific techniques related to the optimization of virtual disks or their compatibility with the host OS which make data extraction from them much more complicated. Among such technologies are:
Chunked virtual disks were introduced by VMware to create FAT-compatible virtual disks. Since FAT has limitations to the size of files, VMware products support splitting a virtual disk into fragments (chunks) that are no larger than 2 GB each. To read such chunked virtual disks it is required to assemble the chunks into one virtual image. The function is available in UFS Explorer Professional Recovery as a special tool "Disk image of chunk files". This can also be achieved using the "New RAID" tool in UFS Explorer RAID Recovery by assembling "Span of storages" from the chunk files.
Parallels virtual machine's bundles were introduced for Paralles Desktop for Mac, in which a virtual disk is packed into a single file along with its snapshots. To get lost data back from this kind of a virtual disk one must extract it from the VM package first. UFS Explorer Professional Recovery is a helpful solution when it comes to data recovery Parallels VM packages.
ESX Storage is a storage space introduced by VMware for ESX/ESXi hosts which enables them to use a number of physical storage systems to store virtual disks. Such disks can be shared over the network from the server, however, there is a common issue when virtual disk files are shared as blank. To access a file of such a virtual disk, the file should first be transferred from the server to the "local" storage. Also, ESX/ESXi servers employ a special clustered VMFS (VMFS6) file system, which allows running multiple virtual machines in parallel, with concurrent access to their virtual disks. UFS Explorer Professional Recovery is capable of opening ESX/ESXi virtual disks and supports the VMFS (VMFS6) file system, serving as an efficient solution for access to files of such storages as well as data recovery from them.
Last update: October 6, 2020