How to Restore Hyper-V Virtual Machines and Checkpoints in Windows Server 2022

• Author:
  
  Vladimir Artiukh
• Editor:
  
  Oleg Afonin
• Updated: 12.09.2026 16:40

Read about how to recover data and restore the operation of Hyper-V virtual machines in Windows Server 2022. The need for recovery often arises due to accidental file deletion in Disk Management, failures of the host operating system, server hardware errors, or logical corruption of the volume containing VHDX files. We will examine in detail the process of automatic search for deleted virtual disks, checkpoints, and reliable recovery of all information.

Contents

• Hyper-V architecture features
• Connecting storage devices
  • METHOD 1. How do you connect server drives to a PC?
  • METHOD 2. Working with disk images
• Recovering Hyper-V virtual machines and their Checkpoints
  • METHOD 1. Recovering virtual machine files
  • METHOD 2. Recovering files from guest OSs
  • METHOD 3. Recovery through Checkpoints
  • METHOD 4. Recovering files from a corrupted VM
• Conclusion
• Frequently Asked Questions
• Comments

Virtualization with Hyper-V is an important component of modern server infrastructure because it allows multiple virtual machines to run on a single physical server. Virtual disks, configuration files, and Checkpoints store important data and the state of virtual systems. However, accidental deletion, file system corruption, Windows Server 2022 failure, or loss of VHDX files can make a virtual machine and its data inaccessible.

In this article, we will look at how to recover Hyper-V virtual machines and their Checkpoints in Windows Server 2022. You will learn where virtual machine files are stored, how to find missing VHDX, AVHDX, and configuration files, and which recovery methods can be used after deletion or corruption. Special attention will be paid to data recovery using the specialized software Hetman RAID Recovery.

Go to view

Recovering Hyper-V Virtual Machines and Checkpoints in Windows Server 2022

Hyper-V architecture features

To successfully recover data, it is necessary to understand the principles of operation of the Hyper-V hypervisor. This system uses several types of virtual disks:

• The first type is Dynamically expanding disks, which increase in size as data is written to them.
• The second type is Fixed size disks, which immediately reserve the entire allocated volume on the physical storage medium.
• The third type is Differencing disks, which are necessarily linked to a parent disk and store only new system changes.

A similar principle is also used in the operation of checkpoints in the Hyper-V environment. When an administrator creates or applies a Checkpoints mechanism, the hypervisor switches the base disk to read-only mode. Above it, a special differencing disk in AVHDX format is created, which captures and stores the current state of the virtual machine before global changes are made. Damage to or loss of even one element in this chain makes it impossible to start the guest system.

In addition to the virtual disks themselves, configuration files in VMCX and VMRS formats play a critically important role. They store all the hardware settings of the virtual machine and information about the state of its RAM at the time the snapshot was created. That is why, for complete and correct recovery of system functionality, the program’s algorithms search not only for VHDX files, but also for the entire set of related service data.

Connecting storage devices

METHOD 1. How do you connect server drives to a PC?

Before starting the data recovery process, you need to disconnect the drives from the problematic server and connect them to your workstation.

The best and most reliable method is a direct connection of the drives to the motherboard through SATA ports or by using additional SAS or HBA expansion cards. This approach provides maximum read speed and ensures stable operation during analysis.

Alternatively, you can use docking stations. However, note that data transfer speed in this case may be lower, which will affect the total scan time.

It is also worth noting an important detail: since our test scenario uses a RAID 5 array as an example, you do not necessarily need to connect all drives for successful assembly and full data recovery. It is sufficient to connect only the minimum required number of operational drives, and the program will automatically calculate the missing data using parity blocks.

METHOD 2. Working with disk images

In practice, it often happens that it is physically impossible to connect all required drives at once due to a lack of free ports on the computer. In such a case, you can use the sector-by-sector image creation function. This is also a standard safety practice when working with disks that show signs of hardware failure or bad sectors.

An image is an exact byte-for-byte copy of your physical disk, saved as a regular file on another storage device with sufficient capacity. You can connect the server drives one by one, create images from them, and then simply load all the resulting files into Hetman RAID Recovery. The program will work with them exactly as it does with real physical devices.

To create such an image, launch the program, select the required drive, and click the Save disk button on the top toolbar. Then simply specify a location to save it.

It is important to remember that the size of the resulting file will fully correspond to the total capacity of the source drive, regardless of the amount of data written to it. Make sure you have enough free space available.

After the save process is complete, open the main menu and select the Mount disk option.

From the offered options, select the Raw disk images type and open the files you have just created.

They will immediately appear in the general list of available devices. The program is now fully ready to automatically assemble your array.

Recovering Hyper-V virtual machines and their Checkpoints

METHOD 1. Recovering virtual machine files

Here, we are using a RAID 5 array as the test environment, with its logical volume encrypted by BitLocker in the Windows Server 2022 operating system.

Typical scenarios of loss of access to virtual machines include accidental deletion of the entire directory by an administrator in the Hyper-V Manager or accidental formatting of the working volume. In such cases, configuration files with the VMCX or VMRS extensions, as well as the virtual disks VHDX themselves, disappear from the storage immediately. However, the data is not physically overwritten right away. The system only removes the records about them from the allocation table, so it is important to stop any write activity on the server immediately and begin recovery.

After the array has been automatically assembled in the program interface, which we launched for this review in the macOS environment, we will see our encrypted partition. Since it is protected by BitLocker, it must be unlocked before searching for data.

Our program supports three types of unlocking:

• you can enter a standard user password;
• use the 48-digit numeric Recovery Key;
• specify the path to a BEK key file if it was stored on a flash drive.

After successful unlocking, click the required logical partition and start the scan using the Fast scan function. This mode analyzes the file system in a matter of seconds. If the required files and folders are not found after Fast scan, you should run a full analysis using the Full scan function.

In the results window, we find the main folder containing the data of our virtual machine.

We always recommend saving the entire virtual machine folder, not just individual disk files. This guarantees that you preserve not only the VHDX drives themselves, but also all system configuration files and any possible Checkpoints chains.

Select the entire folder, click the Recovery button, and specify a path on the local drive of the computer. The main rule is to save the recovered information to another physical storage device to avoid accidental overwriting of the original data on the array.

METHOD 2. Recovering files from guest OSs

There are situations when the storage itself is functioning normally, but important information has been accidentally deleted directly from within the guest operating system. To recover this data, you do not need to deploy the virtual disk on a new server or start the Hyper-V hypervisor. The Hetman RAID Recovery program allows you to mount files directly in its interface and work with them as with regular physical drives directly in your system, such as on our Mac mini.

And the same rule applies here: when using the Mount disk tool, we always mount the entire saved virtual machine folder, because the program needs access not only to the disks, but also to the system configuration and Checkpoints files.

After mounting the folder, the disks appear in the general list of devices.

Let us look at the recovery process using a logical disk containing data from our guest operating system as an example. Click the mounted partition and обязательно start with the Fast scan mode. If it does not find all the required files, then switch to the Full scan mode for a deep byte-by-byte analysis of the internal structure.

The vast majority of information is recovered correctly. The program finds all available deleted documents, photos, or databases. You can verify their integrity using Preview, then select the required objects and save them to a safe location on your workstation.

METHOD 3. Recovery through Checkpoints

Special attention should be paid to working with Checkpoints. When creating these snapshots, the hypervisor does not copy the entire disk. It switches the current base virtual disk to read-only mode and creates a special differencing disk in AVHDX format alongside it.

All subsequent system changes and new files are written to this additional disk. If several such snapshots are taken, an entire chain of dependent files is formed. This architecture makes it possible to recover data with remarkable precision. If you accidentally deleted files inside the machine, their original blocks may remain preserved inside earlier Checkpoints.

Since we mounted the entire virtual machine folder, the program automatically loads all available differencing disks and can read them directly.

In our test example, we can see two different AVHDX files. The first file contains the state of the system immediately after the base files were written, while the second reflects the changes after new test data was added.

By opening a specific Checkpoint in the program, you get full access to the information exactly in the state it was in at the moment this snapshot was created.

For searching lost data, we again first run the Fast scan algorithm, and if the required files are not found, we use Full scan. This significantly speeds up the recovery process, because you restore the data directly from the Checkpoint without performing a complex rollback of the entire virtual machine through the console.

METHOD 4. Recovering files from a corrupted VM

This method will be useful if the previous steps did not produce the expected result and the folder containing the configuration files could not be found.

It is important to understand the difference between virtual disk types in such situations. If your deleted machine used a Fixed size disk, it is usually recovered completely. Since such a volume reserves the entire allocated space immediately upon creation as a full continuous array, its architecture preserves integrity.

In contrast, the situation with Dynamically expanding disks is completely different. They allocate space during operation, so their blocks are often fragmented. After such a machine is deleted, part of the important VHDX file descriptors may be irreversibly overwritten.

Because of this, it is often not possible to recover such a virtual disk as a single file. In such a situation, an effective solution is to scan the file system of the guest operating system itself. This approach allows you to ignore the damaged Hyper-V structure and direct the program to search for your files directly.

To do this, you need to run the Full scan analysis again on the logical volume, but this time change the search focus. You should manually select the file system that was used inside your virtual machine. Since Windows was used in our example, we leave the NTFS file system selected.

After the deep scan is complete, you will no longer see the familiar folder structure of the virtual machines. Instead, the program will output the files directly from inside the guest system, sorting them by format and extension.

All that remains is to review the found documents, archives, or databases, select the most important ones, click the Recovery button, and save them to a separate safe storage device.

Conclusion

Recovering Hyper-V virtual machines and their Checkpoints in Windows Server 2022 may be required after accidental file deletion, storage corruption, server failure, or loss of access to virtual disks. Successful recovery depends on the state of the file system, the integrity of VHDX and AVHDX files, the availability of configuration data, and the nature of the damage.

For recovery, it is important to correctly determine the location of the virtual machine files, check the state of the virtual disks and checkpoints, and preserve the original structure of their chain. In the event of data deletion or corruption, it is not recommended to continue writing to the affected disk, as this can reduce the chances of successful recovery.

If the standard tools of Windows Server 2022 and Hyper-V do not help, you can use specialized data recovery software. Hetman RAID Recovery makes it possible to analyze disks, find lost files, and recover data from damaged or deleted partitions. With its help, you can attempt to restore Hyper-V virtual disk files, including VHDX, as well as other important data required to bring virtual machines back into operation.

Regular backups, keeping Checkpoints, and monitoring storage health help reduce the risk of virtual machine loss in the future. Combining proper backup organization, timely diagnostics, and reliable recovery tools significantly increases the chances of restoring data after unexpected failures.