Virtual machines data recovery

Virtualization popularity of in modern IT-world is constantly growing. The use of these type of systems affords ground for the running of various operating systems on one physical computer, which cuts costs due to server consolidation, speeds up software development process, simplifies infrastructure management, improves fail-operational capability, and much more. Here are some of the most populare virtualization systems as of today: VMware ESXi, VMware Workstation, Hyper-V, VirtualBox, KVM, Xen.

Virtualization systems are installed on servers that consist if the tools that increase their fail-operational capability (RAIDs with redundancy, ECCRAM, uninterrupted power supply units, etc.), but even in these cases, there is a risk of losing access to them.

The most common cases of data loss on virtual drives:

• physical damage to the storage drive;
• logical design damage;
• software breakdown;
• impact of viruses and malware;
• accidental or intentional data removal;
• file internal structure damage.

Data recovery from virtual machines is rather labour-consuming and often non-routine task. This is because the virtual machine represents a file (set of files) that emulates the operation of PC. It consosts of:

• File that describes the list of virtual hardware (processor, RAM, video adapter, floppy/optical disk drive, etc.).
• Files that describe specific hardware.
• Files that emulate operation of virtual hardware (BIOS, RAM, virtual drive).

Virtual drive is of the greater value when recovering virtual machine files, since it contains important user information (operating system with installed software and setups, databases, documents, etc).

In some cases, virtual drives file recovery files in no way different from recovery of any other files. However, additional difficulties arise if internal structure of a file (hardware and software failure, partial rerecording of new information) is damaged. In this case recovery success is directly dependent on degree of damage and expert's qualification.

The difficulty while damaged virtual drives recovery is that expert shall have profound knowledge of not only the internal file system structure that is used, but the internal file format of the virtual drive as well. It should be noted that various manufacturers use various formats (vmdk, vdi, vhd, etc.) and not all of them are open, which significantly complicates the task.

Availability of advanced tools for the work with damaged storage drives, vast experience of EPOS engineers, detailed study of the internal structure of the virtual drive files of various manufacturers allow us to recover the maximum amount of data.

Virtual machines data recovery with retention of its functionality and all the information stored in it is considered to be the best possible result of work. If there are major damages, the most valuable files on the virtual drive are recovered.

To increase the chances of successful recovery of virtual machines it is recommended to provide the drive on which the files were before the failure.