Recovering deleted files in VMware is an important data protection capability that every VMware administrator should be familiar with. Having the ability to restore lost or accidentally deleted files can prevent data loss disasters and minimize downtime after an unfortunate deletion event. With the right tools and knowledge, recovering deleted files in VMware is often possible.
A key best practice is maintaining regular backups of your virtual machines and data. With a recent backup, you have a quick and easy way to restore missing files should you need them. Backups provide an insurance policy against data loss. However, even without backups, there are techniques for recovering deleted files directly from VMware. This guide will explore the various methods available.
Prerequisites
Before attempting to recover deleted files in VMware, you’ll need to have some basic VMware knowledge and access to the vSphere Client. Here are the key prerequisites:
- Understanding of core VMware components like ESXi, vCenter Server, and vSphere Client
- Access to vCenter Server and the vSphere Client
- Administrator privileges in vSphere to manage VMs and datastores
- Knowledge of storage locations like datastores and VMDK files
VMware recommends ESXi hosts have at least 8GB RAM and a solid state drive for optimal performance [1]. vCenter Server should have at least double the hardware resources of the overall environment [2]. With the proper VMware infrastructure in place, you’ll be ready to start recovering deleted files.
Locate Deleted Files
The first step in recovering deleted files in VMware is to locate where the missing files were stored. This can be done using the vSphere client to browse the datastores:
Use the vSphere client to navigate to the datastore where the deleted virtual machine files were stored. Expand the datastore and click on the folder path where the files originally existed. VMware maintains a folder called “lost+found” where deleted files are moved for a period of time before being permanently deleted.
Check the “lost+found” folder to see if the deleted files have been moved there. The files may still have their original name. VMware will keep deleted disk files (VMDK files) in this location for 8 days by default before deleting them permanently.
You can also sort the datastore folders and files by “Date Modified” to identify recently deleted files. If you know the approximate time the files were deleted, sort by most recent date modified to quickly find them.
Additionally, the vSphere client shows deleted virtual machines in the inventory with a “greyed out” icon. You can right click on these and select “Restore deleted virtual machine” to initiate the restoration process if deleted recently.
Using the vSphere client to browse is often the fastest way to locate recently deleted VM files that may still be recoverable from the datastore.
Source: Undelete deleted VM with vSphere Web Client
Restore from Recycle Bin
VMware has a recycle bin feature that allows you to recover deleted virtual machines or files within a virtual machine. To enable the recycle bin in VMware:
1. Right-click on the VMware datastore and select “Properties”.
2. Go to the “General” tab and check the box next to “Enable Recycle Bin”.
3. Configure the recycle bin settings like capacity and aging and click “OK” to save.
Once enabled, deleted virtual machines and files will be moved to the recycle bin instead of being immediately deleted. To restore a deleted file:
1. Right-click on the VMware datastore and select “Browse Files”.
2. Navigate to the “.recycle” folder.
3. Locate and right-click on the deleted file and select “Restore”.
The selected file will be restored to its original location. The recycle bin capacity is limited, so it’s recommended to monitor it and empty it regularly.
Source: https://www.quora.com/Is-there-a-recycle-bin-in-VMware
Restore Previous Versions
One way to recover deleted files in VMware is by reverting to a previous snapshot or backup of the virtual machine. VMware allows you to take snapshots of a VM’s disk and configuration state periodically. These snapshots can then be used to roll back the VM to a previous point in time.
To restore a previous version in vSphere:
- In the vSphere client, right-click on the VM and select Snapshots > Snapshot Manager.
- Locate the snapshot you want to revert to in the list and click on it.
- Click the “Go to” button to temporarily view the snapshot.
- Click on the snapshot again and select “Restore to snapshot” to permanently roll back.
This will revert the VM’s disks and configuration to the state saved in the snapshot, recovering any files and data that existed at that point. However, any changes made after the snapshot was taken will be lost. Snapshots are crucial for protecting against accidental guest OS changes and deletions.
VM backups can also be used to restore deleted files by recovering the entire VM to an earlier backup point. This is done by replacing the existing VM with the backed up version.VMware offers built-in backup solutions like vSphere Data Protection to schedule VM backups.
Additionally, the ESXi hypervisor itself can be downgraded to a previous version if needed to recover lost files. This is done by booting into ESXi recovery mode and selecting an older ESXi build from the menu (Source: https://4sysops.com/archives/roll-back-and-downgrade-vmware-esxi-version/). However, compatibility issues may arise when reverting to older versions.
Restore from Backup
One of the most reliable ways to recover deleted files in VMware is to restore from a recent backup. VMware offers built-in snapshot and backup capabilities, but most organizations use third-party backup software for more advanced functionality.
Popular VMware backup solutions include Veeam Backup & Replication, Veeam Backup Free Edition, Altaro VM Backup, and Zerto. These tools allow you to schedule regular backups and set retention policies to store point-in-time copies of your VMs and data.
To restore a deleted file from a VMware backup:[https://www.ubackup.com/enterprise-backup/vmware-restore-from-backup.html]
- Launch the backup software and browse the available restore points
- Select the backup copy you want to restore from
- Navigate to the deleted file and select it
- Choose a restore destination and start the restore process
The key advantage of restoring from backup is you can recover files even if they were deleted long ago. But this method relies on having a backup in place before files were deleted.
Recover Deleted VMDK
If a VMDK file has been accidentally deleted from the datastore, it is possible to recover it by detaching the deleted VMDK and attaching it to another VM:
First, use the vmkfstools command to detach the deleted VMDK. The command will look something like this:
vmkfstools -X /vmfs/volumes/datastore1/myvm/myvm.vmdk
Where /vmfs/volumes/datastore1/myvm/myvm.vmdk is the path to the deleted VMDK.
Detaching the VMDK will recreate its descriptor file, allowing it to be attached to another VM. Next, create a new VM or locate an existing VM to attach the recovered VMDK to. Open the VM settings and add a new hard disk, selecting the recovered VMDK file. The deleted VMDK can now be accessed from the attached VM.
Once the deleted files have been recovered, the VMDK can be detached from the temporary VM and reattached to the original VM if needed. This allows recovery of deleted VMDKs without loss of data.
Use File Recovery Software
There are several software options available to recover deleted files from VMware. Some popular recovery tools include:
- Recoverit Data Recovery – A comprehensive recovery tool that can recover deleted files from VMware and various storage media. It has a user-friendly interface and powerful scanning capabilities. (Source)
- DiskInternals VMware Recovery – Specifically designed to recover deleted VMware files. It can recover VMDK, VMEM, VMX and other VMware file types. (Source)
- Kernel for VMDK Recovery – Specialized in recovering VMDK files from VMware ESXi hosts. It scans storage media and restores damaged or deleted VMDK files.
The steps to recover deleted files using recovery software are:
- Download and install the recovery software on your computer.
- Launch the software and select the VMware disk image (VMDK file) to scan.
- The software will scan the storage device and display recoverable files.
- Preview and select the files you wish to recover.
- Specify a location to save the recovered files.
- Finally, recover the deleted files. Make sure to save them to a different drive.
File recovery software provides an easy way to get back deleted files from VMware backups and images. With powerful scanning algorithms, these tools can find and restore deleted data even if the original files were overwritten.
Best Practices
Following best practices for data protection and snapshot management can help minimize the need for deleted file recovery in VMware environments. According to the VMware Data Recovery Administration Guide (https://www.vmware.com/pdf/vdr_11_admin.pdf), regular backups are crucial.
Create backups of critical VMs on a daily or weekly basis. More frequent backups provide more restore points to recover from accidental deletions. Configure backup jobs to run automatically on a schedule. Store backups on a separate device or cloud repository in case of hardware failure.
In addition to backups, leverage VM snapshot capabilities according to VMware’s recommendations (https://kb.vmware.com/s/article/2017368). Take snapshots before major configuration changes to revert if needed. Schedule periodic snapshots to capture VM states over time.
However, avoid excessive snapshots that bloat the virtual disk and degrade performance. Consolidate or delete outdated snapshots regularly. With diligent backup and snapshot procedures, deleted file restores become less frequent.
Conclusion
Recovering deleted files in VMware can be a straightforward process if done properly. The first step is locating the deleted files and identifying where they were stored. Search the virtual machine’s recycle bin and look for previous versions that may contain the deleted data.
Restoring from backups is also an option if recent ones are available. For deleted VMDK files, VMware tools like vSphere can restore these disk images. Finally, third party file recovery software provides a last resort for retrieving data that cannot be recovered through VMware directly.
Following best practices like regular backups and snapshots can prevent file loss from becoming catastrophic. With the right tools and methods, deleted VMware files can usually be salvaged unless they have been purged from the system entirely.