Top Tools to Recover Data from VMFS, ESXi, Vsphere Hypervisor Virtual Disks

In today’s article, we will explore top tools to recover data from VMFS, ESXi, and vSphere hypervisor.

Top Tools to Recover Data from VMFS, ESXi, Vsphere Hypervisor Virtual Disks

Go to view
⬆️ Top Tools to Recover Data from VMFS, ESXi, vSphere Hypervisor Virtual Disks

⬆️ Top Tools to Recover Data from VMFS, ESXi, vSphere Hypervisor Virtual Disks

VMFS is a file system developed by VMware to be used with ESX and vSphere servers. Since VMFS is mostly intended for storing ESX virtual machine disk images, it is designed to work with relatively small number of large files. The storage space for an VMFS volume may be represented as a single disk or as several disks (or hardware RAID systems). In its turn, the VMFS driver combines extents of available storage space into a JBOD.

VMFS file system scheme

In VMFS, metadata is located at the beginning of the volume, or – if there are several extents – at the beginning of the first extent. This metadata includes indexes and descriptors, directories and a repository for small files.

VMFS structure

To store virtual machine disk images, VMFS uses clusters of 1 MB each, – and this is larger than used in any other file system. Therefore, a file could not occupy less space than 1 MB, but for special approaches developed for smaller files. Beginning with VMFS 5, files which are less than 1 KB are stored immediately in corresponding index descriptors, just like resident attributes in NTFS.

Storing data in VMFS

For files larger than 1 KB VMFS creates a one big file and cuts it into clusters of 8 KB each, which are then used to store small files. Such approach allows to reduce disk space usage for storing small-sized files.

All VMFS metadata is usually stored within the first 3 or 5 GB of a volume which means that the entire structure can be recovered after scanning only the first 5 GB of an VMFS volume.

In Windows, you need a specialized utility to view the contents of a disk with the VMFS file system. Data recovery tools that support this file system can display the disk contents and allow to save the information stored on the device.

I have a hard disk with VMFS version 6, which I have taken from an ESXi server, and we’ll try to extract the virtual machine disks with Linux from there. Let’s connect the hard disk to a Windows computer and start the testing.

ESXi disk on VMFS

For tests, I have selected 6 utilities whose developers claim they can recover data from VMFS. These include AnyRecover VMFS Recovery, BitRecover, Disk Internals (VMFS Recovery), Hetman Partition Recovery, ReClaime Pro, and UFS Explorer.

As you can see, there are not so many tools that support data recovery from VMFS, and what is more, most of them cannot identify this file system on the disk, despite their claims.

For example, AnyRecover VMFS Recovery – https://www.anyrecover.com/deleted-files-recovery-data/vmfs-recovery/ – even fails to detect our VMFS disk.

Let’s see how it identifies the disk partitions.

In the end, it says our VMFS partition is identified as unknown. In this case, it’s not even worth scanning the it, since the program is not going to find anything.

One more program that claims to support VMFS – Bitrecover (VMFS Recovery Wizard) – https://www.bitrecover.com/vmfs-recovery-software/

The developer’s official website mentions VMFS support and the ability to recover files from this file system. In fact, though, when the program starts, it asks you to give the path to virtual files.

However, it doesn’t recognize the VMFS disk that we have. It looks like this utility only supports recovery operations from virtual disk files. We’ll put it aside until the final test of recovering data from a virtual machine disk. So far, it seems to either lack support for VMFS version 6, or it doesn’t support this file system at all.

Another participant is Disk Internals (VMFS Recovery) – https://www.diskinternals.com/vmfs-recovery/mounting-vmdk/. It can see a volume on the VMFS disk, and it can recognize its size and name. In the preview mode, the utility can see virtual machine files which remained on the disk.

With a quick scan, the result is similar. It retains disk structure and all virtual machine files, and after the quick scan, it found some of the removed files. Later, we’ll see if it can extract information from recovered virtual disks.

Hetman Partition Recovery

Now let’s see how Hetman Partition Recovery handles this challenge.

The tool recovers data from any devices, regardless of the cause of data loss.

This recovery tool also identifies VMFS volumes on our test disk. After Fast scan, it detected datastore and virtual machine files which remain on the disk.

Hetman Partition Recovery

This utility supports most virtual machine files and file systems including VMFS, and you can use it to effortlessly recover lost data both from VMFS volumes and VMWare ESXi or vSphere hypervisor virtual disks. The program can find both existing and deleted files.

Recover files

The contents of all files can be checked with the preview feature, and you can search files by name, which helps you find the necessary data even quicker. The virtual disk files have been recovered in full. Since the program retains the disk structure, all files and folders are in their proper directories, which also adds greatly to your convenience in searching for lost data. In the next test, we’ll see if the program can extract files from a recovered virtual disk file.

ReclaiMe Pro

Meanwhile, we’ll check how another tool faces this challenge – ReclaiMe Pro – http://www.reclaime-pro.com/manual/vmfs-recovery.aspx. Its official website claims it’s a professional data recovery tool designed to be used by data recovery technicians, so home users may encounter difficulties if they try it. And that is true: when started for the first time, the utility suggests setting a proxy server.

ReclaiMe Pro

Then you need to decide which disks to scan and select their file system. Only after the scan, we will see the list of disks and their partitions.

ReclaiMe Pro scan

In the end, this is our disk, and the program has also identified the VMFS VMWare datastore and its size. At the next stage, you have to scan the partition, choosing some scan options.

ReclaiMe Pro has identified a VMFS disk

The program does not allow us to view the disk contents without running a scan first. As a result, the program managed to find virtual disk files, but it doesn’t display any deleted files.

ReclaiMe Pro has found virtual disk files

UFS Explorer

Finally, the last participant – UFS Explorer. The utility detected a VMFS partition on the disk. You can view its contents even without scanning – by just opening it, but in that case you’re not going to see the deleted files.

UFS Explorer

Let’s see what this tool can find after running a quick scan. It’s going to take about 8 to 9 minutes. It’s longer than Hetman Partition Recovery and Disk internals, but it’s also much faster than having to wait for the results with ReclaiMe.

The tool managed to find all virtual machine disk files, including configuration files. We were able to recover the data in full, but soon we’ll see if we can upload them to the hypervisor. In the next test, we’ll check if this utility can extract the information from them.

UFS Explorer has found the files

After scanning for lost data, the program doesn’t display the deleted files.

The second test: Recovering data from VMWare ESXi, vSphere hypervisor virtual disk

In the second – and final – test, we’ll compare how different tools manage to extract files from the virtual disk which was previously recovered from the VMFS partition. AnyRecover VMFS Recovery failed the first test, and it is likely that this program doesn’t support VMFS.

BitRecover (VMFS Recovery Wizard) also fails to identify the file system on our disk. As to the virtual disk files, this program is unable to recover virtual machine data.

Bitrecover VMFS Recovery Wizard

In the final test, it failed to find any information on the virtual disk. All it displays is an empty folder.

DiskInternals

Now let’s check Disk Internals.

For this virtual disk, a quick scan is not available, and DiskInternals only offers a full scan.

Diskinternals VMFS Recovery

As a result, the program has found the files stored on the virtual machine disk; they are displayed in the preview, so you can check the contents of photos, videos, and documents. The disk structure is retained, but it couldn’t find any deleted files.

Diskinternals VMFS Recovery - file recovery

Hetman Partition Recovery

Now we’ll test Hetman Partition Recovery.

Let’s mount the virtual disk file – vmdk. Here’s our disk, and the program managed to identify the file system of the virtual machine automatically.

Hetman Partition Recovery - mounting VMDK files

Let’s try Fast scan first. All right: the program has found all the files remaining on the disk. It also displays some of the deleted files, and you can preview all files – videos, photos, and documents.

Hetman Partition Recovery - recovering files

It shows previously deleted files as well: you can identify them by red crosses.

ReclaiMe Pro

Once again, ReclaiMe makes you go through several setting screens before you can mount a virtual disk file.

ReclaiMe Pro - mounting a VMDK image

A quick scan finds the files which are on the disk, and the disk structure is retained; you can see all the files remaining on the virtual disk. Previews are available for photos and videos; documents cannot be previewed, so their recovery prospects are not clear yet. The program was unable to find the deleted files.

ReclaiMe Pro - recovering files

Also, full scan takes quite long: in fact, this tool has the longest disk scan time of all. It’s been over two hours since we started scanning a relatively small disk, but the program has only analyzed less than half of it, and it hasn’t found any deleted files yet. Maybe it’s time we moved on to another recovery tool.

UFS Explorer

Let’s mount virtual disk files.

UFS Explorer displays their size properly, so let’s start the scan. Only scanning for lost files is available.

UFS Explorer - mounting a VMDK file

It displays the files which were stored on the virtual disk. In the preview, we can check photos and videos, but documents are not displayed.

Document recovery seems questionable as they cannot be previewed, and you have to buy the full version of the program in order to save the files. Similarly to the case of ReclaiMe, it is difficult to understand if the files are going to be recovered in full before you actually buy the utility.

UFS Explorer - recovering files

After searching for lost files, it managed to find a few deleted elements: two files of ten in this folder.

Conclusion

So, what can be said in the end? Out of all the programs we have tested, two programs have a zero result – they are AnyRecover VMFS Recovery and BitRecover (VMFS Recovery Wizard). ReclaiMe and UFS Explorer fail to display previews for documents, and in the final test, they were unable to find deleted files on the disk. DiskInternals has found and recovered virtual disk files, and in the second test, it found files from the virtual machine disk, but unfortunately, it didn’t find any deleted files.

Hetman Partition Recovery has found and recovered virtual disk files, and in the second test, it found all photos, documents and videos – even those that have been deleted. Also, it lets users preview all file types – photos, videos, and documents. One more thing is that some programs from today’s selection don’t support mounting disk images – which is, in fact, an important feature for any data recovery product.

Typically, manufacturers use the RAID technology to arrange file storage on an ESXi server, so in this case, Hetman RAID Recovery will be a good choice.

Recover data from damaged RAID arrays inaccessible from a computer.

This utility supports recovery from most file systems, including VMFS, and most RAID types. If you have formatted a VMFS partition or volume by mistake, this software will help you recover your data from any selected VMFS disk or partition. It supports all file types created by VMware software and ESXi or vSphere server, as well as the latest version of the file system, VMFS6.

Vladimir Artiukh

Author: , Technical Writer

Vladimir Artiukh is a technical writer for Hetman Software, as well as the voice and face of their English-speaking YouTube channel, Hetman Software: Data Recovery for Windows. He handles tutorials, how-tos, and detailed reviews on how the company’s tools work with all kinds of data storage devices.

Oleg Afonin

Editor: , Technical Writer

Oleg Afonin is an expert in mobile forensics, data recovery and computer systems. He often attends large data security conferences, and writes several blogs for such resources as xaker.ru, Elcomsoft and Habr. In addition to his online activities, Oleg’s articles are also published in professional magazines. Also, Oleg Afonin is the co-author of a well-known book, Mobile Forensics - Advanced Investigative Strategies.

Recommended For You

Hello! This is AI-based Hetman Software virtual assistant, and it will answer any of your questions right away.
Start Chat