Problem description:
The host has two directly attached volumes
ESXI 4.1 was installed on Volume1
Host was upgraded to ESXI 5.1
Then VMFS was upgraded from v3 to v5
Then ESXi5.0 was installed on Volume1 and datastore appeared clean
(overwritten?)
Is it possible to restore datastore or vmdk-files?
I just post this for your information ... in case someone runs into something similar ...
Here is what I did to recover the most important vmdks:
after a short skype chat to find out what happened I told the user to use a Linux LiveCD with vmfs-fuse to check if the datastore really is empty.
vmfs-fuse could mount the volume but it appeared completely empty.
I asked for a dump of the first 1500 Mbs of the volume and for details about the missing vmdks.
The vmdks all used truecrypt and were either 40, 60 or 80 Gb large - all thick provisioned.
I wrote a script for a indepth scan of the datastore - and asked the user to run it overnight.
It was finished after 2 hours for a 1.5 Tb datastore.
After checking the 1500 Mb dump and the scan results I then was able to create a script to extract the flat vmdks via dd.
With 9 possible starting points and 3 different file sizes we had to check out 27 different files in worst case.
We were lucky and only needed to test the first 8 or 9 extracted files - then we already had what we were looking after.
Until today I had thought that truecrypt would reduce the chance for a recovery - but now I think it actually makes it easier.
With Truecrypted vmdks I actually get less false candidates than usual ....
So dont give up too early - vmdks can be recovered even if vmfs-fuse and ESXi sees a blank directory
Ulli