Skip to main contentSkip to navigation
Lab Operational Since: 17 Years, 10 Months, 10 DaysFacility Status: Fully Operational & Accepting New Cases

Enterprise Virtualization Recovery

VMware ESXi Data Recovery

We recover VMFS datastores from failed RAID arrays, repair broken snapshot chains, and extract individual .vmdk virtual disks from corrupted ESXi hosts and vSAN clusters. Free evaluation. No data = no charge.

Author01/14
Louis Rossmann
Written by
Louis Rossmann
Founder & Chief Technician
Updated August 2026
18 min read
Overview02/14

How VMware ESXi Datastores Fail and How We Recover Them

VMware ESXi stores virtual machines on VMFS (Virtual Machine File System) datastores backed by RAID arrays. When the underlying array degrades, the ESXi host loses access to the VMFS volume and all VMs on it go offline. Recovery requires imaging the RAID member drives, reconstructing the array offline, and parsing VMFS metadata to extract each .vmdk virtual disk file.

VMFS is a clustered filesystem designed for shared storage access across multiple ESXi hosts. It uses on-disk locking mechanisms (heartbeat regions and ATS primitives on VMFS6) to coordinate concurrent access. When a RAID failure corrupts the metadata that describes the volume, the lock state becomes inconsistent and ESXi refuses to mount the datastore. Standard VMware tools (vmkfstools, vscsiStats) cannot repair a datastore with underlying media errors. The data must be recovered at the physical layer first.

VMFS Architecture03/14

VMFS Metadata Architecture and Failure Points

VMware has never published the VMFS on-disk format, so a recovery works from what the volume itself contains rather than from a documented structure map. VMFS5 and VMFS6 differ in block allocation, UNMAP behavior, and snapshot format, and when the metadata that describes the volume is damaged, the mount fails entirely.

VMware does not publish the VMFS on-disk format, and the descriptions that circulate come from reverse-engineering work rather than from VMware. We treat the datastore as an unspecified container: the recovery reads what is actually on the images and works from that, rather than assuming offsets a vendor never documented.

VMFS6 Differences from VMFS5

  • Automatic UNMAP (space reclamation) runs in the background, which can zero-fill previously allocated blocks on thin-provisioned LUNs
  • SE Sparse (Space Efficient Sparse) snapshot format replaces vmfsSparse by default; uses grain directories and grain tables with a default 4KB grain size for block-level change tracking
  • Native 512e and 4Kn drive support; VMFS6 aligns I/O to physical sector boundaries, affecting how data is laid out on AF drives
  • GPT-based partition layout on the backing LUN (newly created VMFS5 also uses GPT; VMFS3 was the last to use MBR, and VMFS5 volumes upgraded from VMFS3 retain MBR until expanded past 2 TB)
  • ATS (Atomic Test and Set) VAAI primitives replace some SCSI reservation locks; ATS misfire during power loss can leave orphaned locks

A stale VMFS heartbeat or ATS orphan lock keeps a datastore inaccessible until the lock state is cleared. That is a distinct problem from VMFS resignaturing: resignaturing is an identity-resolution operation ESXi performs when a LUN's physical identifier (NAA or EUI) changes while the on-disk VMFS UUID stays the same, which is what happens on an array snapshot, clone, or replica. Resignaturing is driven by that identifier mismatch, never by stale-lock or heartbeat state, so the two are handled by separate recovery paths.

When a RAID member fails mid-write, the VMFS journal may contain an incomplete transaction. ESXi attempts to replay this journal on mount. If the journal references sectors that are now unreadable (because the RAID array is degraded), the mount fails entirely. Our approach bypasses the ESXi mount process: we parse the VMFS volume directly from the raw RAID image and locate each .vmdk and its extents there, regardless of journal state.

Snapshot Recovery04/14

ESXi Snapshot Chain Reconstruction

Snapshot chains in ESXi consist of a base .vmdk and one or more delta files (-delta.vmdk using vmfsSparse on VMFS5, -sesparse.vmdk by default on VMFS6). Each delta records changed blocks relative to its parent. When the chain breaks, the VM cannot power on and standard consolidation fails.

How Snapshot Chains Break

  1. CID mismatch: Each VMDK descriptor contains a Content ID (CID) and a Parent Content ID (parentCID). When a snapshot is created, the new delta's parentCID must match the parent's CID. ESXi crashes or storage disconnects during snapshot creation can leave these values out of sync.
  2. Orphaned deltas: Failed "Delete All Snapshots" operations can leave delta files on disk with no corresponding entry in the VM's .vmsd snapshot descriptor file. The snapshot manager no longer tracks these deltas, but the VM still references them in its disk chain.
  3. Corrupted grain tables: SE sparse deltas on VMFS6 use grain directories and grain tables to map changed sectors. A power loss during a grain table update can corrupt the mapping, causing reads to return incorrect data or I/O errors.

We reconstruct broken chains by reading the grain directory from each delta, determining the correct parent-child ordering from creation timestamps and CID values, and manually consolidating the changed blocks back into the base extent. The result is a single flat .vmdk representing the VM's most recent consistent state.

vSAN Recovery05/14

vSAN Distributed Datastore Recovery

VMware vSAN aggregates local SSDs and HDDs from multiple ESXi hosts into a single distributed datastore. VM storage objects are split into components and distributed across hosts according to a storage policy. FTT=1 defaults to mirroring but can use RAID-5 erasure coding; FTT=2 defaults to triple mirroring but can use RAID-6 erasure coding, depending on the failure tolerance method (FTM) setting. Multi-node failures or CMMDS metadata corruption can take the entire vSAN datastore offline.

  • CMMDS reconstruction: The Cluster Monitoring, Membership, and Directory Service maintains a distributed database of all object locations across the cluster. When CMMDS becomes inconsistent (typically after simultaneous host failures), we rebuild the object map by scanning each host's capacity disks for object headers and component metadata.
  • DOM object reassembly: The Distributed Object Manager splits each .vmdk into components (up to 255GB per component on most vSAN versions). Each component is a RAID-1 mirror or RAID-5/6 stripe across disk groups. We locate each component on the physical disks, reconstruct the stripe or mirror, and reassemble the full .vmdk from its component pieces.
  • Disk group structure: Each vSAN disk group contains one SSD cache tier and up to seven HDD/SSD capacity devices. The SSD cache provides a write buffer (and read cache in hybrid configurations); deduplication metadata, when enabled, resides on the capacity tier. We image the capacity devices (where persistent data resides) and use the cache device to resolve any in-flight writes.
  • Witness and stretched clusters: Two-node vSAN configurations use a witness host for quorum. If the witness becomes unavailable simultaneously with a data node, the remaining node cannot confirm object ownership. We bypass the quorum requirement by working directly with the physical disk images.
Failure Scenarios06/14

Common ESXi Failure Scenarios We Handle

RAID Array Degradation

PERC or Smart Array controller detects multiple failed members. ESXi host loses access to the VMFS LUN. All VMs on the datastore go offline simultaneously.

VMFS Metadata Corruption

Power loss during a metadata commit leaves the volume's metadata inconsistent. ESXi refuses to mount the datastore with "cannot open the disk" or "no such file" errors.

Failed Snapshot Consolidation

"Delete All Snapshots" task fails, leaving orphaned delta files. The VM runs on an increasingly fragmented chain until the datastore fills or performance degrades to zero.

ESXi Boot Failure / PSOD

ESXi host fails to boot after firmware update, boot media corruption, or a Purple Screen of Death (PSOD) kernel panic. VMs are intact on the VMFS datastore but inaccessible without a running hypervisor.

vSAN Multi-Node Failure

Power event takes down multiple vSAN hosts simultaneously. Object components become stale across the cluster and vSAN cannot rebuild without manual intervention.

Accidental VM Deletion

VM removed from inventory or .vmdk files deleted from the datastore browser. VMFS does not immediately zero-fill freed blocks, so recovery is possible if no new writes have overwritten the extents.

Methodology07/14

Recovery Methodology for IT Administrators

Each member drive is imaged to capture every addressable LBA. PERC controllers store their DDF metadata in the last sectors of each member drive; this metadata block contains the RAID level, stripe size, and member ordering. We parse the VMFS volume directly from the raw image and extract each .vmdk with its flat extent data.

This section details the low-level procedures we use. If you are evaluating our technical capability, this is how the work gets done.

1. RAID Member Imaging with Sector-Level Granularity

Each member drive is imaged through PC-3000 using SAS HBAs for SAS drives or NVMe adapters for PCIe SSDs. The imaging process captures every addressable LBA, including those beyond the standard ATA/SCSI command set boundary (service area, G-list entries). For drives with bad sectors, we configure PC-3000 head maps to skip damaged heads on initial passes and return to them with aggressive retry parameters after capturing all healthy sectors. DeepSpar Disk Imager provides hardware-level timeout control for drives that lock up during reads.

2. Controller Metadata Extraction

PERC controllers store their DDF (Disk Data Format) metadata in the last sectors of each member drive. This metadata block contains the virtual disk configuration: RAID level, stripe size, member ordering, rebuild checkpoint, and consistency state. Smart Array controllers use a similar reserved area but with an HP-proprietary format. Data Extractor Express RAID Edition reads these metadata blocks and uses them to reconstruct the virtual disk layout without needing the original controller hardware.

For arrays where the metadata has been overwritten or zeroed (firmware flash gone wrong), we fall back to brute-force parameter detection: testing stripe size permutations (64KB, 128KB, 256KB, 512KB, 1MB) and member orderings against known filesystem signatures.

3. VMFS Parsing and VMDK Extraction

With the RAID image reconstructed, we parse the VMFS volume directly from the raw image. The process identifies the VMFS version and volume parameters from the volume's own metadata, then scans the image for entries matching .vmdk, .vmx, .nvram, and .vmsd file types.

For each .vmdk, we read the descriptor file to determine whether it is a monolithic flat disk, a split sparse, or a snapshot delta, then locate its flat extent data on the reassembled image. The extracted .vmdk is verified by mounting it read-only and checking guest filesystem integrity (NTFS, ext4, XFS) with standard filesystem tools.

4. Hyper-V Coexistence

Environments migrated from Hyper-V to ESXi (or running both) may contain .vhdx files stored on VMFS datastores. We extract .vhdx files using the same VMFS parsing pipeline and process them separately. VHDX uses a 4KB log structure for crash consistency, and recovery follows the same image-first, parse-from-raw methodology. For broader server recovery needs including Hyper-V standalone environments, see our main server recovery page.

Recovery Stack08/14

How Does the VMFS-over-RAID Recovery Stack Get Reconstructed?

VMFS is a clustered filesystem sitting on top of the reconstructed RAID volume, so recovery runs strictly bottom-up: the block device is rebuilt and cloned read-only first, then the VMFS volume, then the .vmdk descriptor and flat extent, then the guest OS filesystem.

A VMware datastore is not a single object. It is a stack of six dependent layers, and a recovery engineer has to traverse them from the physical disks upward. Skipping a layer, or touching a higher layer before the one beneath it is stable, is how recoverable data gets destroyed. The stack, traversed bottom-up:

  1. Physical controller metadata. The SNIA Disk Data Format (DDF) on Dell PERC and LSI/Broadcom MegaRAID trailing sectors, or the HP Smart Array RIS (RAID Information Sector) at the start of each member drive. This block carries the RAID level, stripe size, member order, and parity rotation.
  2. The virtual RAID block device, reconstructed in software from read-only images of every member drive.
  3. The VMFS clustered filesystem laid on top of that block device.
  4. The .vmdk descriptor, the small text file that maps the virtual disk geometry and createType.
  5. The -flat.vmdk data extent, the raw block content of the virtual disk.
  6. The guest OS filesystem (NTFS, ext4, or XFS) written inside the virtual disk.

VMFS is a clustered filesystem sitting on top of the reconstructed RAID volume, so the block device beneath it must be perfectly reconstructed and cloned read-only before any VMFS parse can begin. A single misplaced stripe or wrong member order produces a block device that looks plausible but yields a VMFS volume that will not parse, or worse, parses into corrupted .vmdk extents. The array geometry comes first; everything above it inherits the errors below it. This is the same bottom-up discipline that governs every array on our RAID data recovery bench.

Host Failure or Datastore Failure?

An ESXi host failure and a datastore failure are different problems with different recovery paths. Diagnosing which one you have is the first decision before any drive is touched.

Host failure
The hypervisor has crashed or the boot device (for example ESX-OSData on an SD card or USB stick) is lost, but the datastores are physically intact on separate storage. This is recovered by migrating the storage to a new host; the array underneath was never damaged.
Datastore failure
The underlying RAID is degraded, or the VMFS metadata is corrupt beneath the volume. This requires rebuilding at the block layer from read-only member images before any VMFS parse, because the storage itself is the problem.

Why Is esxcli or vmkfstools Dangerous on a Degraded Array?

Running esxcli storage operations or vmkfstools against a degraded array is dangerous because both issue writes to the live members. Lock claims, UNMAP commands, and VMFS metadata commits all land on the array as it sits, and on a degraded array those writes can overwrite the surviving parity that a reconstruction depends on. Every RAID member drive is hardware-imaged read-only first (SATA and PATA members on our PC-3000 Express, SAS members through sector-level imaging), and the array is then reconstructed virtually in Data Extractor Express RAID Edition against the image files, never against the live disks.

The same rule defeats the URE problem. A degraded array is imaged member-by-member before any rebuild is attempted, because recalculating parity across a degraded array forces a full-surface read of every survivor, and consumer SATA drives are rated at roughly one Unrecoverable Read Error per 10^14 bits read (about 12.5 TB). Hitting a URE during a live rebuild halts parity calculation and can crash the array; imaging first moves that risk onto a copy where a bad sector costs nothing.

Does a Dead RAID Controller Destroy the Array Configuration?

No. A failed RAID controller does not destroy the array configuration. The RAID metadata lives on each member drive, not only in controller NVRAM: the SNIA DDF on Dell PERC and LSI/Broadcom MegaRAID trailing sectors, and the HP Smart Array RIS at the start of each drive. A dead Dell PERC H730 or LSI/Broadcom MegaRAID card leaves the RAID level, stripe size, member order, and parity rotation intact on the disks themselves. The array reconstructs virtually in Data Extractor Express RAID Edition from read-only member images, without the original controller card. We fall back to brute-force stripe and order detection only when that on-disk metadata has been zeroed or overwritten.

Path Failure09/14

What Is the Difference Between an APD and a PDL Datastore Failure on ESXi?

APD (All Paths Down) is a transient state where every path to the storage device is lost but the device never signals it is gone, so ESXi keeps queuing and retrying I/O. PDL (Permanent Device Loss) is when the device itself returns a SCSI sense saying it is permanently gone, so ESXi fast-fails immediately. Both leave the VMFS datastore in a state that demands read-only member imaging before any re-mount or resignature.

When a RAID controller drops out, or a NAS/SAN array goes offline, without returning a device-gone SCSI sense, ESXi sees All Paths Down. The Native Multipathing Plugin (NMP) holds the paths in a dead or standby state and I/O is queued and retried rather than failed. ESXi fast-fails the queued I/O only after the Misc.APDTimeout host advanced setting elapses (default 140 seconds), and VM Component Protection (VMCP) reacts only after that APD timeout has passed. The APD fast-fail timer is Misc.APDTimeout, not the unrelated HA isolation-response setting das.isolationshutdowntimeout.

PDL is the opposite signal. The storage device returns a SCSI sense indicating the LUN is permanently gone, canonically sense key 5h with ASC 25h (LOGICAL UNIT NOT SUPPORTED). ESXi marks the device dead at once and terminates I/O instead of retrying, and VMCP can force-power-off the affected VMs so they can be restarted on a host that still has the LUN. The canonical PDL sense is 5h/25h.

The recovery implications differ but the safe path is identical. An APD-era datastore may carry in-flight I/O that left VMFS metadata half-written; a PDL-era datastore may have uncommitted VMFS journal entries. In both cases:

  • Image every member drive read-only first. SATA and PATA members go on the PC-3000 Express; SAS members run through a SAS HBA with sector-level imaging.
  • Reassemble the array virtually in Data Extractor Express RAID Edition from those read-only images, never against the live members.
  • Run a VMFS consistency check with voma -m vmfs -f check (and -f fix only) on a read-only clone. The VMFS check and repair tool is VOMA, not vmkfstools --repair.

Never run repair on the live datastore, and never resignature or re-mount before imaging. Resignaturing is a separate operation: it resolves a LUN UUID or identifier mismatch on a clone, snapshot, or replica, and it is never driven by APD or lock state.

Repair Tooling10/14

Which VMware Tools Repair a VMFS Datastore?

VMware ships two, and they operate on different objects. voma, the vSphere On-disk Metadata Analyzer, inspects VMFS filesystem metadata. partedUtil operates on the partition table of the block device the datastore lives inside. Neither one repairs failing hardware, and neither one can tell that the array under the LUN is degraded while it writes.

voma Command Modes for VMFS Metadata

voma picks what it examines with the -m module flag; -m vmfs targets a VMFS datastore. The -f flag decides whether the run reads or writes.

voma -m vmfs -f check
Inspects the VMFS metadata for inconsistencies and reports what it finds without modifying the disk. Check mode is the documented read-only pass, and on a datastore that matters it is the only pass to run until the block layer beneath it has been proven sound.
voma -m vmfs -f fix
Attempts to repair the inconsistencies that check mode found. Fix mode is documented behavior of the tool, not a guarantee that the datastore mounts afterward, and it inherits every error present in the block device underneath it.

Preconditions Before Running voma

VMware documents the state the volume has to be in before either mode is worth typing. The fourth precondition below is our own bench rule, not VMware's.

  1. Unmount the datastore, or power off and migrate every VM that lives on it. voma is documented to run against a volume that is not in service.
  2. Confirm the volume is fully accessible to the host. A LUN sitting in APD or PDL is not fully accessible, so it fails this precondition before a command is entered.
  3. On a spanned or multi-extent volume, verify every extent is present and accessible. voma does not reconstruct an extent the host cannot see; a missing extent is a block-layer problem and stays one through every filesystem tool VMware ships.
  4. Rule out media errors first. voma is built for minor logical inconsistencies. A volume backed by storage with underlying media errors or hardware failure is out of scope for it, and that covers a degraded array, a failing member drive, and a LUN returning SCSI sense.

voma Fix Mode Commits Metadata Writes

-f fix rewrites filesystem metadata structures on the volume it is inspecting. That is the correct behavior when the inconsistency is logical and the storage under it is sound. On a degraded array it is the wrong behavior: the blocks voma reads back are reconstructed from parity, and on a degraded array that parity can already be wrong, so the metadata fix gets committed on top of an inaccurate picture, onto the same member drives a later reconstruction depends on.

Fix mode inherits the URE problem too. Every block the missing member held gets computed from the corresponding stripe units on the survivors, and rebuilding that member forces a full-surface read of every one of them. Consumer drives are rated at roughly one Unrecoverable Read Error per 10^14 bits read, about 12.5 TB, so a stripe reconstructed from a bad read reaches voma looking like filesystem corruption. Fix mode will write a correction for it. That arithmetic is the whole argument for imaging a degraded array instead of rebuilding it, with ddrescue or PC-3000 hardware, before any repair command runs.

Why Can't partedUtil Repair VMFS Metadata?

partedUtil never reaches the filesystem. It operates strictly on the partition table, the GPT written on the block device, and its documented subcommands do exactly that: partedUtil getptbl reads the current table, setptbl writes a new one, and fix attempts to repair a damaged GPT header. Files, folders, and .vmdk extents sit outside its scope. Its job is defining where the partition begins and ends.

That boundary is where the self-inflicted ESXi partition failure happens. Administrators widely report recreating a partition entry with setptbl and a starting sector that does not match the original. The filesystem inside is untouched, but the host now looks for the VMFS volume header at the wrong offset, so the header is unaddressable and the datastore will not mount. The answer is not a second repair command. It is recovering the original boundary from a read-only image of the device, which is server storage recovery work.

VMFS 5 and VMFS 6 Differences That Change a Repair

A repair attempt against VMFS 6 is not the same job as one against VMFS 5. Three differences change what a tool can get back.

BehaviorVMFS 5VMFS 6
Space reclamationBlocks freed by a deletion commonly survive long enough that carving them back succeeds.Automatic asynchronous UNMAP sends SCSI UNMAP to the array, so deleted blocks get reclaimed quickly and carving after a deletion is far less likely to succeed.
Snapshot deltasvmfsSparse deltas.seSparse deltas for every snapshot, which changes how a tool walks the chain.
Sector format and partition layoutNewly created volumes use GPT; volumes upgraded from VMFS3 keep MBR until they are expanded past 2 TB.512e and 4Kn support with a differing GPT layout, so repair software parses the geometry with updated offset expectations.

Automatic UNMAP is the difference that decides whether a deleted VM is still on the storage at all. On VMFS 6 the window between deleting a VM and losing the blocks it occupied is short, which is why deleted VMDK recovery on a VMFS 6 datastore is a race the host wins if you leave it running.

Where Admin Repair Ends and Lab Reconstruction Starts

Admin-side, in place. The host boots, the controller reports the array healthy, and the inconsistency is purely logical, the kind a sudden power loss leaves behind. Unmount the datastore, run voma -m vmfs -f check, read what it reports, and decide from there whether fix mode is warranted.

Lab-side, from cloned members. The array is degraded, drives have failed, the controller is offline, or the block device is returning read errors and SCSI sense. Every member is imaged read-only first on PC-3000 hardware or a DeepSpar Disk Imager, the array geometry is then reconstructed in software with Data Extractor Express RAID Edition against those image files, and only then does a filesystem tool get pointed at the reconstructed volume. Running voma against a live degraded array skips the step that makes its output mean anything.

Both halves of that boundary run in-house at our Austin lab, alongside the rest of our array reconstruction work. No diagnostic fee, and no recovery fee if the data does not come back.

VMDK Internals11/14

VMDK File Format and Descriptor Reconstruction

VMware virtual disks consist of two parts: a descriptor file (plain text, typically under 1KB) and one or more data extents containing the actual disk content. When the descriptor is lost or corrupted, the data extent is an opaque binary blob that ESXi cannot address. Reconstruction requires understanding the VMDK format at the byte level.

monolithicFlat
A single contiguous data extent file (-flat.vmdk) paired with a descriptor. Standard format for thick-provisioned VM disks on VMFS. The descriptor's RW line defines the extent size in 512-byte sectors.
twoGbMaxExtentSparse
Splits the virtual disk into multiple 2GB sparse extents. Used when exporting VMs for transport (OVF/OVA). Each extent has its own grain table tracking allocated blocks. Recovery requires reassembling the extents in the correct sequence defined by the descriptor.
vmfsSparse VMFS5 Snapshots
Delta files (-delta.vmdk) used by VMFS5 for snapshot change tracking. Each delta records changed 512-byte sectors relative to its parent. The grain directory maps changed sectors to their physical location in the delta file.
seSparse VMFS6 Snapshots
Space-Efficient Sparse format (-sesparse.vmdk), default on VMFS6. Uses 4KB grain size for finer-grained change tracking and supports space reclamation. The grain directory and grain table structure is more complex than vmfsSparse, with a two-level lookup (directory → table → grain).

Descriptor File Reconstruction

When the descriptor file is missing but the flat extent remains on the VMFS volume, we reconstruct it by calculating the extent boundaries. For a 40GB monolithicFlat disk, the sector count is 40 × 1,073,741,824 / 512 = 83,886,080 sectors. The reconstructed descriptor maps this extent with the correct createType, CID, and parent references. For virtual machine disk recovery involving snapshot chains, the CID and parentCID values in each delta descriptor must match; a single mismatch renders the chain unreadable.

# Reconstructed VMDK descriptor (monolithicFlat)
version=1
CID=d0f5e5f6
parentCID=ffffffff
createType="vmfs"

# Extent description
RW 83886080 VMFS "server-flat.vmdk" 0

# Disk Data Base
ddb.virtualHWVersion = "21"
ddb.geometry.cylinders = "5221"
ddb.geometry.heads = "255"
ddb.geometry.sectors = "63"
ddb.adapterType = "lsilogic"
ESXi 8 vSAN12/14

ESXi 8.0 and vSAN 8 Storage Architecture Changes

ESXi 8.0 introduced structural changes to the boot and storage layout that create new failure patterns for IT administrators to manage. These changes affect both standalone ESXi hosts and vSAN clusters.

ESX-OSData Partition Wear

ESXi 7.0 introduced ESX-OSData, replacing the legacy /scratch partition, which stores VMware Tools images, host configuration, core dumps, and diagnostic logs. This partition generates sustained write activity. Hosts booting from SD cards or USB devices (common in ESXi 6.x and 7.x deployments) experience rapid media wear because these devices were never designed for continuous write workloads. VMware deprecated SD/USB media as a standalone boot device in vSphere 7.0 Update 3 and 8.0 for this reason, requiring a persistent local disk for the ESX-OSData partition's sustained writes rather than banning SD/USB boot outright. When the boot device fails, the host goes offline but the VMFS datastores on separate storage remain recoverable.

vSAN 8 Persistent Disk Headers

When deactivating a vSAN 8 cluster (OSA or ESA) to repurpose drives for local VMFS datastores, the physical disks retain low-level vSAN partition metadata. ESXi flags these drives as "In-use by vSAN" and blocks VMFS initialization. The standard fix is esxcli vsan storage remove -s <naaid>, but if the vSAN cluster is already destroyed, the disk group membership cannot be cleanly removed through the CLI. We handle these drives by reading and clearing the partition headers at the byte level during the imaging process.

RAID rebuild warning: If the VMFS datastore sits on a RAID array where one or more members have failed, do not initiate a RAID rebuild. Rebuilding a degraded array forces parity recalculation across surviving members, and the sustained full-surface read can finish off a marginal survivor.

Legacy and low-end controllers (and HP Smart Array P/E-series) then drop that member and abort the rebuild; modern Dell PERC and LSI/Broadcom MegaRAID puncture the affected stripe and continue, losing only that stripe's data, and Linux mdadm logs the unreadable LBA to its Bad Block Log.

Either way the lost stripe can land on VMFS metadata or a VMDK flat extent, so on irreplaceable, unbacked data we image every member read-only first rather than rebuild in place. Power down the server and contact us for evaluation.

Pricing13/14

VMware Recovery Pricing

VMware datastore recovery follows the same transparent pricing model as every other service: a per-member imaging fee based on each drive's condition, plus a separate array reconstruction fee ($400-$800) covering VMFS parsing, RAID reassembly, and VMDK extraction. No data recovered means no charge.

Service TierPrice Range (Per Drive)Description
Logical / Firmware Imaging$250-$900Firmware module damage, SMART threshold failures, or filesystem corruption on individual array members.
Mechanical (Head Swap / Motor)$1,200-$1,50050% depositDonor parts consumed during transplant. SAS drives require SAS-specific donors matched by model, firmware revision, and head count.

No Data = No Charge: If we recover nothing from your VMware environment, you owe $0. Free evaluation, no obligation.

We publish our pricing. The work is the same regardless of what label gets put on the invoice.

We sign NDAs for corporate data recovery. All drives remain in our Austin lab under chain-of-custody documentation throughout the process. We are not HIPAA certified and do not sign BAAs, but we are willing to discuss your specific compliance requirements before work begins.

Faq14/14

VMware ESXi Recovery; Common Questions

What causes VMFS datastore corruption and can it be recovered?
VMFS corruption typically results from underlying RAID array degradation, sudden power loss during metadata commits, or ESXi host crashes during snapshot operations. The metadata that describes the volume can become inconsistent, leaving the datastore unmountable. Recovery involves imaging the RAID members, reconstructing the array, and locating the .vmdk files and their flat extents on the reassembled images.
Can you fix a broken ESXi snapshot chain?
Yes. ESXi snapshot chains consist of a base .vmdk descriptor, one or more -delta.vmdk (or -sesparse.vmdk on VMFS6) files, and a .vmsn memory state file. When a chain breaks, the CID/parentCID references in the descriptor files no longer match. We reconstruct the chain by reading the grain directory and grain tables from each delta, reordering them by creation timestamp, and consolidating the writes back into a single flat extent.
How do you recover data from a failed vSAN cluster?
vSAN distributes VM storage objects across local SSDs and HDDs in each ESXi host using a distributed object manager (DOM). When multiple nodes fail or the CMMDS (Cluster Monitoring, Membership, and Directory Service) metadata becomes corrupted, the datastore goes offline. We image the capacity drives from each affected node, reconstruct the DOM object layout, and extract the component pieces of each .vmdk across the cluster.
Does the ESXi version affect recovery?
Yes. VMFS5 (ESXi 5.x/6.x default) uses a unified 1MB block size. VMFS6 (ESXi 6.5+ optional, 7.x+ default) introduced automatic UNMAP, 512e/4Kn drive support, and SE sparse snapshots. ESXi 7.0 introduced the ESX-OSData partition, and ESXi 8.0 added the vSAN Express Storage Architecture (ESA), both of which changed boot device requirements and storage layout. Our tooling handles all current VMFS versions.
Can you recover thin-provisioned VMs that were deleted from the datastore?
If the VMFS metadata entries for the deleted .vmdk have not been overwritten, we can recover the file by locating its physical extents on the imaged volume. Thin-provisioned disks allocate blocks on demand, so recovery depends on how much of the freed space has been reused since deletion. Power down the host as soon as possible to prevent overwriting.
How much does VMware datastore recovery cost?
Same transparent model as all our services: a per-member imaging fee based on each drive's condition, plus a separate array reconstruction fee ($400-$800) covering VMFS parsing, RAID reassembly, and VMDK extraction. No data recovered means no charge.
Is it safe to run vmkfstools or filesystem checks on a corrupted VMFS datastore?
If the underlying cause is physical media degradation (failing SSDs, a degraded RAID array with bad sectors), running vmkfstools or any filesystem repair tool is dangerous. These utilities attempt to force logical consistency by overwriting orphaned metadata entries, which permanently destroys unmapped VMDK data. The drives must be hardware-imaged through write-blocked interfaces first. Filesystem repair only belongs on a copy, never on the original media.
Why does ESXi report 'In-use by vSAN' when creating a new VMFS datastore?
Drives previously in a vSAN 8 cluster (OSA or ESA) retain low-level partition headers after deactivation. The ESXi storage stack detects these headers and blocks VMFS initialization. Clearing the headers requires removing the vSAN disk group membership via 'esxcli vsan storage remove' or zeroing the partition tables through low-level storage access. Attempting to force initialization without clearing these headers will fail.
Can you reconstruct a missing or corrupted VMDK descriptor file?
Yes. A VMDK descriptor is a small text file that maps the geometry of the virtual disk. If the descriptor is deleted or corrupted but the -flat.vmdk data extent remains intact, we reconstruct the descriptor by calculating the extent size (total bytes / 512 = sector count), determining the createType (monolithicFlat, twoGbMaxExtentSparse, etc.), and writing a new descriptor with the correct RW extent mapping. The Content ID (CID) is regenerated to match any existing snapshot chain references.

Data Recovery Standards & Verification

Our Austin lab operates on a transparency-first model. We use industry-standard recovery tools, including PC-3000 and DeepSpar, combined with strict environmental controls to maintain drive integrity. This approach allows us to serve clients nationwide with consistent technical standards.

Transparent History

Serving clients nationwide via mail-in service since 2008. Our lead engineer holds PC-3000 and HEX Akademia certifications for hard drive firmware repair and mechanical recovery.

Media Coverage

Our repair work has been covered by The Wall Street Journal and Business Insider, with CBC News reporting on our pricing transparency. Louis Rossmann has testified in Right to Repair hearings in multiple states and founded the Repair Preservation Group.

Aligned Incentives

Our "No Data, No Charge" policy means we assume the risk of the recovery attempt, not the client.

We believe in showing the bench rather than just describing it. Open-drive work runs on a 0.02 micron ULPA-filtered laminar clean bench, and we filmed it.

See the particle counter test at the bench

Verified on Google

What Server Recovery Customers Say

4.9 / 51,837 Google reviewsverify on Google Maps
Had a raid 0 array (windows storage pool) (failed 2tb Seagate, and a working 1tb wd blue) recovered last year, it was much cheaper than the $1500 to $3500 Canadian dollars i was quoted by a Canadian data recovery service. the price while expensive was a comparatively reasonable $900USD (about $1100 CAD at the time). they had very good communication with me about the status of my recovery and were extremely professional. the drive they sent back was Very well packaged. I would 100% have a drive recovered by them again if i ever needed to again.

Christopolis

Seagate

View on Google
HIGHLIGHT & CONCLUSION ******Overall I'm having a good experience with this store because they have great customer services, best third party replacement parts, justify price for those replacement parts, short estimate waiting time to fix the device, 1 year warranty, and good prediction of pricing and the device life conditions whether it can fix it or not.

Yuong Huao Ng Liang

iPhone

View on Google
Didn't *fix* my issue but a great experience. Shipped a drive from an old NAS whose board had failed. Rossmann Repair wanted to go straight for data extraction (~$600-900). Did some research on my own and discovered the file table was Linux based and asked if they could take a look. They said that their decision still stands and would only go straight for data recovery.

Mac Hancock

View on Google
I've been following the YouTube tutorials since my family and I were in India on business. My son spilled Geteraid on my keyboard and my computer wouldn't come on after I opened it and cleaned it, laying it upside down for a week. To make the story short I took my computer to the shop while I'm in New York on business and did charged me $45.00 for a rush assessment.

Rudy Gonzalez

MacBook Air

View on Google

Ready to recover your VMware environment?

Free evaluation. No data = no charge. Mail-in from anywhere in the U.S.

(512) 212-9111Mon-Fri 10am-6pm CT
No diagnostic fee
No data, no fee
4.9 stars, 1,837+ reviews