Virtual machine data recovery

A virtual machine is a set of files on a volume, usually on a RAID array. When something fails, it is often one layer below the VM: the disks, the RAID set, the datastore filesystem, or the virtual disk files themselves. Recovery means working through those layers in order, from images of the physical disks.

• VMFS datastore missing or showing as unmounted after a power event or a controller fault.
• Hyper-V volume or Cluster Shared Volume offline, or a VHDX that won’t attach.
• Broken snapshot or checkpoint chains, including delta disks that no longer link to their parent.
• Thin-provisioned disks that ran out of space and left the VM corrupted.
• VMs deleted by mistake, or a datastore re-created or formatted over the old one.
• The RAID array under the host degraded or failed, taking every VM with it.

• Do power the host down if the datastore sits on failing disks or a degraded array.
• Do note the hypervisor version, the datastore names and which VMs matter most.
• Do send every disk from the array, labelled with its bay number.
• Don’t re-create, format or re-initialize the datastore or volume.
• Don’t consolidate or delete snapshots on a damaged chain.
• Don’t run chkdsk, fsck or a vendor repair tool inside a damaged VM or on the host volume.
• Don’t restore backups onto the original disks. Restore to different storage.

Clone first. Every physical disk is imaged with hardware that retries gently. All later work happens on the images, never on your originals.

Rebuild the storage. If the datastore sat on RAID, we work out disk order, stripe size and parity from the images and assemble the array in software.

Recover the datastore and the virtual disks. We read the VMFS, NTFS or ReFS volume, find the VMDK or VHDX files and their snapshot or checkpoint chains, and repair the links between them where we can.

Check the data inside. A virtual disk that opens is not the end of the job. We check the filesystems and the files that matter to you, such as databases, mail stores and shared folders, before we call it recovered.

Virtual servers often hold client records, accounting databases and email. Written chain-of-custody is available on request, from intake to return.

• Recovered files or virtual disks are returned on new media.
• We don’t keep copies of your data longer than needed to confirm delivery.
• We only clone and read the disks. We don’t write to your originals.

Logical jobs, like a deleted VM or a damaged virtual disk on healthy drives, usually take 24–48 hours. Physical and RAID jobs, like failed disks under the datastore, usually take 3–7 days once all disks arrive.

The evaluation is free. You get a fixed quote before any paid work, and if we can’t recover the data you need, you don’t pay the recovery fee. We have been recovering data since 1991, with 15,000+ cases recovered and a 95% success rate.

Call the 24/7 emergency line at (410) 937-7332, bring the disks to our Columbia lab at 10015 Old Columbia Rd, Suite B 215, Columbia, MD 21046, or ship them to us free both ways. Form enquiries get a reply within one business day.

What affects the cost →