Easy data recovery for the VMware virtual machine

This article is a case of data recovery of VMware virtual machine. Although the whole process of data recovery of VMware virtual machine only needs three steps, the problem analysis and experience summary before and after are worth your reference.

Summarize the data recovery case of one VMWARE ESX SERVER taken over a few days ago

[data recovery failure description]

A provincial branch of sinopec, information management platform, several VMware virtual machines -- ESX SERVER Shared 1 IBM DS4100 storage, about 40 to 50 virtual machines, occupying 1.8 TB space, data is important.

During normal operation, the virtual disk is reported missing in vc. ssh checks the disk by executing fdisk-l in ESX and finds that storage has no partition table. After restarting all devices, ESX SERVER is unable to connect to STORAGE where DS4100 is located.

Ask the administrator carefully, they mentioned 1 point, once connected to an windows 2003 server in this storage network, the specific situation is unknown.

[data recovery analysis]

Naturally, it occurred to me that the entire vmfs volume was damaged by the exclusive operation of windows 2003 to storage.

Analysis of the entire storage found:

1, partition table clear 0, with 55aa valid end mark, hard disk ID mark.

2, simple view from the front to rear, found a NTFS roll, but does not seem to be writing data into, like a just formatted volumes, analyzing the NTFS volume BITMAP do, that size is about 1.8 T all (space), the front take up some space, about 3 G occupy part of the space location, near 0.9 T occupy part of the space, but not more than 100 M total footprint.

3, in view of the VMFS volume were analyzed, and found in the original 1.8 TB disk with 2 groups VMFS partitions, group 2 is extend of group 1, group 1 is about 1.5 T, about 300 GB group 2, because NTFS partition does not write data to the second VMFS partition (the last one sector DBR backup does not cover useful data), so the emphasis is on the first VMFS partition.

4. Analyze the first group of VMFS, the volume head structure is missing, level 1 index and level 2 index exist, and the data area covered by NTFS happens to be the temporary memory image of a group of virtual machines, so it is ok to damage it.

[data recovery takes only 3 steps]

1. Mirror the entire STORAGE.

2. After analysis, connect the two VMFS partitions and extract all VMDK and configuration files directly according to the VMFS analysis organization method.

3. Direct migration back to ESX SERVER via nfs.

In addition: in this case, since a safe backup of the failed storage has been made, the first group of VMFS volume header, index list, partition table and other information are directly rebuilt during the repair, which are directly attached to the ESX SERVER environment, which is the second scheme.

[data recovery results]

It took 2 days (excluding the subsequent migration time) for all data to recover successfully

[other]

1. In this case, the problem is still caused by the improper mutual exclusion of the optical fiber environment. In fact, the volume should be repartitioned in the WINDOWS system and formatted as NTFS, and then the partition is deleted. Since the mutual exclusion of ESX VMFS does not depend on the hardware, but only on the operating system driver layer, you must be careful when other servers access the storage network and consider the storage allocation rights as much as possible.

2. Because of convenient centralized information management, ESX is very important in real use. 1.