Last week I received a call from a client who had a problem regarding VMWare 5.0 and a mounted share. Initially the client asked me if there was a way to do VMDK Data Recovery on a VMDK File that had been deleted. In answer to this I explained that it would depend upon the circumstance of the deletion as well as how the volume was used after the deletion.
When informing me what had happened to the partition after the file was deleted he said that the VMFS partition had been deleted and that it had been setup using fdisk for ext2/3/4 and then formatted for ext4. So in essence, the VMDK was not deleted it was the VMFS partition that was deleted and overwritten with a completely different file system type which includes all of the meta data related to the file system.
The EXT file system series has a very intrusive method for storing the indexes to the file names as well as how the block map is stored in the inode structure. In order to understand how much damage can be done to the front of a partition of a different file system type, a brief explanation of the on disk layout of the EXT file system is warranted.
EXT is broken up into six metadata types. First there is the super block which houses the volume information. Next are the group descriptors which describe the placement of each data group. Third is the block bitmap which describes the placement of used and unused data blocks. The inode bitmap follows that with the same intent as the block bitmap only for the inodes. There is the inode table and finally we get to where the data is actually stored. Each one of these metadata storage areas can extend to as large as several megabytes and even into the gigabyte size range.
In other words, the metadata can overwrite the front of a partition and destroy any remnants of an old file system. The front of a partition is normally where the most important data is stored for most file systems and VMFS is no exception.
In this particular case there was no need for VMDK Data Recovery because the VMFS volume was 12 terabytes and the metadata for the EXT file system was extensive.
It destroyed the VMFS file system metadata and made recovery virtually impossible.
