What should you do if disaster strikes

• – Do not use any utility software if your hard disk is making noise, such as scraping, tapping, clicking, or humming sound, or if the drive is unstable with read errors.
• – If your device suffers from physical damage or makes unusual sounds, do not turn it on.
• – Shut down your computer to avoid further damage to your drive and its data.
• – Trying to recover the data by yourself, using over-the-counter tools, is a risk,  as you may cause further damage to your drive and permanent data loss.
• – Set up another computer or server to replace the damaged unit and restore available backups onto the new unit to begin productive work.

Contact us for further assistance and emergency tips

Avoid data loss – safety tips

• Always back up your data, especially when upgrading your system. Make sure that copies of your most important data are being kept off site
• Always turn your computer off using the operating system shut down process
• Always use up-to-date hardware and software utilities for data security, such as virus protections and firewalls
• Laptops should be operated on a hard and flat surface to allow proper ventilation and to avoid over heating
• Servers should have fans, ventilation or portable air conditioning systems as close as possible to avoid operating in high temperatures.
• Allow enough space around the external drive’s cooling fans and remove any items that may block air flow
• Do not turn off peripheral devices while computer is on, or when disc is active
• Drives should be stable and stationary when operating. If you have to move your computer – turn it off first
• When touching or handling the media, make sure to avoid static electricity
• If you hear unusual sounds coming from your computer, turn it off immediately to avoid further damage

Case Scenarios and Action Steps

Symptom 1

You hear a clicking noise coming from the computer.

Reason

• The reason for this issue in many cases is a head crash or bad head alignment that causes the HD to fail to initialize.
• It can happen to a new as well as an old HD, with older drives being more prone to head crashes and head failures.
• Action Turn off the computer immediately and bring the HD to a data recovery expert.
• The longer you continue to work with the computer attempting to access the HD, the lower the chances that you will have a successful recovery.
• MEDIA

HD 2.5”,1.8” (Laptop), HD 3.5” (Server), RAID Array.(Server)

Symptom 2

In many cases a hard drive crash is followed by reduced or slow computer performance.

Reason

• The reason for this issue is in many cases caused by overheating.
• It can happen to a new as well as an old HD, with older HD being more prone to overheating issues.
• Action
• In cases where you experience these symptoms, and you don’t have access to your operating system. STOP! Do not continue to use the computer.
• Turn off the computer and immediately bring the HD to a data recovery expert.

MEDIA

HD 2.5”,1.8” (Laptop), HD 3.5” (Server), RAID Array.(Server)

Symptom 3

You deleted a file and emptied the recycle bin/trash can.

Reason

• Human Error.
• Action
• STOP! Shut down the computer immediately using the physical power button, in order for the system to stop writing any data the HD and bring it to data recovery expert.
• If you continue to use the computer after the file/folder got deleted you can lower the chances that you will have a successful recovery of the lost files or folders.

MEDIA

HD 2.5”, 1.8” (Laptop), HD 3.5” (Server, Desktop), RAID Array.(Server)

Symptom 4

You formatted a HD with important data.

Reason

• Human Error.
• Action
• Stop working on the computer, shut down the computer and bring it to a data recovery expert.
• the more actions you will do to that specific HD, the lower the chances that you will have a successful recovery.

MEDIA

HD 2.5”, 1.8” (Laptop), HD 3.5” (Server, Desktop), RAID Array.(Server)

Symptom 5

You deleted pictures in your digital camera.

Reason

• Human Error.
• Action
• Stop working immediately with the camera and take the memory card out.
• Bring it to a data recovery expert. We can help recover the deleted pictures.
• The longer you will use the camera after the pictures got deleted, the lower the chances that you will have of a successful recovery.

MEDIA

All digital camera memory cards.

Symptom 6

You formatted the memory card on the digital camera.

Reason

• Human error.
• Action
• Stop working immediately with the camera and take the memory card out.
• Bring it to a data recovery expert., We can help recover the formatted memory card.
• The longer you will use the camera after the memory card was formatted, the lower the chances that you will have a successful recovery.

MEDIA

All digital camera memory cards

Symptom 7

One or more of a RAID array drives failed or the RAID array failed to initialize and you no longer have access to the array data.

Reason

• One or more of the HD failed or the array controller failed.
• Action
• Stop working immediately with the server, number the order of the HD (0,1,2…) and bring that array preferably with the array controller to a data recovery expert.
• If the array failed to load, do not try to replace a HD, in case the array did not initialize it would not help and might cause the rebuilding on the array and you could lose the data completely.
• Do not try to replace a controller – it doesn’t have the raid information structure of the old one and you might accidentally initialize the RAID array and delete the existing information.
• Be advised that most RAID array data losses are caused by human errors.

MEDIA

RAID array (SCSI + ATA + SATA)

Symptom 8

Backup Tape couldn’t be read by the tape drive or the backup software while performing a restore of a backup.

Reason

• Magnetic Tape might be old and has some surface problem.
• Action
• Bring the Tape for a diagnosis to a data recovery expert.
• Please be advised that in some cases it’s easier and cost effective to recover data from damaged HD than a tape. In cases where you are restoring data because of other failed media we would like to evaluate both backup tapes and hard drive.

MEDIA

Magnetic Tape.

Contact us

Phone:

Toll Free – USA & Canada 866-400-DATA (866-400-3282) International +1-212-594-5946 UK/EMEA: + 44 (800) 0903179 Spain: + 34 (800) 080040 | France: + 33 (805) 321066 | Germany: + 49 (32) 214219688 | Netherlands: (20) 369-0725 | Mexico: 558-526-2541 Live Support Phone Hours: Mon.- Fri. 9:00am – 8:00pm – EST | Sat.-Sun. 10:00am – 2:00pm – EST Emergency Critical Response is available 24/7

Email:

CSR @ WeRecoverData.com

Contact Form:	Recovery Inquiries	Lab
	Technical Support (Pre or Post Recovery)	Press Relations
	Customer Service	Job Opportunities

Software to Extract Deleted Virtual Machine Files from a VMFS Volume

Project Title    Software to Extract Deleted Virtual Machine Files from a VMFS Volume

Project Start Date: 2016/06

Project Completion Date: 2016/08

Field of Science or Technology: Software Engineering and Technology

Purpose of work

To achieve technological advancement for the purpose of creating new or improving existing materials, devices, products or processes.

Experimental Development:

Overcoming Uncertainties, Work Performed, Achievements, and Outcome

Background:

We received a large multi-volume RAID storage array that utilized a Virtual Machine File System (VMFS) as the host file system. The file system contained files for multiple virtual machines (VMs) in the client’s environment. The array suffered a multiple drive failure, therefore the client and their IT consultants attempted to replace and rebuild the failed drives in the storage array. The overall storage system contained multiple independent RAID arrays and volumes, and drives from different arrays were placed in incorrect positions when rebuilt. Due to the extensive amount of damage resulting from the incorrect rebuild, the VMFS volumes would no longer mount.

Goal:

We attempted to recreate the original configuration in our labs by removing the drives that were known to be invalid and rebuilt those from parity. The result was a very damaged file system, but there was still a large amount of file system metadata and user data that was not damaged. There are very few companies that deal with highly damaged VMFS file systems, so any tools found on the internet were very basic and were only useful with undamaged or lightly damaged structures.

Our aim was to reverse engineer the VMFS metadata structures in order to see if it was possible to manually extract deleted/missing virtual machine (VM) files. The publicly available tools claimed to recover deleted files, but didn’t address file systems that were either reformatted or missing some of the original file metadata. If we were successful at extracting the deleted VM, we needed to see if it was possible to repair missing/corrupted structures since we highly suspected damage due to the incorrect RAID rebuild. If this wasn’t possible, we wanted to investigate if it was possible to create a utility to extract the virtual machine files and patch areas where the metadata traversed corrupted areas. With the lack of accurate technical documentation and an no publicly available utilities to recover highly damaged VMFS hosts, we were uncertain whether it would even be possible to reach our goal.

The overall (damaged) storage array submitted for recovery was suitable for our research purposes since it contained 3 different VMFS volumes, therefore we had a cross section of VMFS volumes of various sizes. This assisted us in the initial stages of reverse engineering the metadata and inode/pointer structures since the differing structure sizes provided additional valuable information.

Through detailed analysis of directory structures, inodes, secondary and tertiary indirect table files we were eventually able to gather enough details of the file system structure in order to navigate through the file structure and hence extract uncorrupted virtual machine (VMDK) files from the VMFS system.

During the examination of corrupted file structures, we noted a regular occurrence of invalid pointers within the indirect pointer files that we assumed were due to the incorrect RAID rebuild by the client. Some indirect pointers that should have been pointing to other pointer tables were either zeroed or contained illegal values. We devised strategies in our experimental utilities that would allow us to extract all valid data, while segregating the corrupt pointers and voiding these areas in the extracted virtual machine file.

In our recovery attempt, we repaired the damaged areas by filling them with legal values that pointed to a signature block that we created. Our hope was that this would essentially mark all invalid areas in the extracted VM files with an identifiable signature so that we would know that those areas corresponded to invalid data pointers. We attempted to mount the volume under Linux vmfs-fuse but it appeared that the modifications were not accepted and the volume would not mount. This was likely due to the severe damage in some other areas of the data and metadata and possibly the fact that many rebuilt pointers were pointing to the same location (this would normally not occur in an operational VMFS volume). Due to this failure, we then proceeded to modify our extraction utility and used it to extract the virtual machine. We had our utility disregard any duplicate pointers as well as some other issues in the volume structures.

The resulting extracted file had all of the retrievable VM data blocks that were possible with the metadata available. Due to data blocks that were corrupted during the rebuild though, corruption that couldn’t be detected earlier became apparent after extraction and examination of the VM file.

We were unable to successfully extract and rebuild a usable virtual machine file for our client since the combination of lost or bad data due to pointer corruption and data area corruption led to a larger amount of invalid areas than initially expected. However, we are able to extract deleted virtual machine files which was our main goal. We can reliably recover deleted files from a VMFS file system if the client submits their case without any further writing to the volume. With knowledge gained, we are also able to recover files from VMFS file systems with moderately damaged internal structures.