Restoring a single file from a snapshot.

[ChrisStankevitz]

Please consider a nightly "backup" that is performed by:

1. Snapshot guest (quiesced)

2. clone the underlying datastore (using "zfs snapshot" in my case which captures all vmdk/vmsd/vmxf/vswp/lck/nvram/etc files)

3. Delete snapshot.

Question: how can I go about retrieving a single file from the guest filesystem from a few days ago?  I have available to me the entire VM directory from the underlying datastore as it was cloned (the files in item 2 above).  I assume my options are:

a. Somehow tell ESXi to bring up the snapshot made in step 2.  Tell ESXi to bring it up in parallel to the live guest which is still running.  Tell ESXi to bring up this backup but without any internet connection so it doesn't interact with the network during the restore.  While the backup is up, retrieve the files I need.

b. Somehow mount the NTFS volume that was captured in step 2.  This may be difficult if the NFTS volume was spanned over several vmdk hard drives (typical 2 TB workaround)

c. <your idea here>

Thank you,

Chris

[CoolRam]

Your question is not clear . are you asking to recover the file from the VM . if you have the snapshot in that file is there then you can do that.

If you want to recover from the esxi which is installed in physical machine then I thing not possible .

[ChrisStankevitz]

I am trying to recover a file that is stored within an NTFS file system which is stored within a VMDK file which is stored within a "snapshot" I took and backed up a long time ago.

[JMachieJr]

I'm not sure if I understand you correctly or not. If you have a copy of the entire folder then all you have to do is add that backup copy of the vm to inventory and power it on. Just make sure you don't have a live network port group configured on the vnic when you power it on. That way it doesn't conflict with the real server. Then you can access the files in the OS. 

[JMachieJr]

You keep saying you have a "snapshot" but a VMware snapshot is not a copy of the VM.

[IIIusion]

Hi Chris - do the following

1. Clone your current VM (don't power it on) and then get rid of all drives (vmdk) except the system drive.

2. Now mount all vmdk from the snapshot where you have file which you want to restore. Of course you need to get this snapshot on the datastore connected to the host.

3. Then remove the NIC from the cloned VM and power it on. Most probably it will load normally and you will see the previous state and the desired file.

4. Now the trick is to copy this file to the original VM. Therefore add new drive to the cloned VM.

5. Format the new disk and copy the desired file

6. Unmount drive from cloned VM and mount it to original VM. Copy it.

Easy 🙂

[bharathl]

Chris, You can try following the steps mentioned by Ray or you can simply attach the vmdk file(add as an existing disk) from your clone to the same VM or a test VM and Windows might automatically detect it as its formatted with NTFS and assigns a drive letter. You can simply copy the file and remove the disk after that.

[lifepo4]

  Sorry, I have no idea how to do that, but I have recovered singles files using VMware Data Protection, it is free as long as you have vSphere Essential Plus 5.5

[brunofernandez1]

normally with all backup solutions you have the possibility to restore a complete VM without to owerwrite the existing VM.

after you restore the vm with a new new you can remove it from inventory and attach the vmdk (Disk file) of the restored VM file to your running VM.

then you have access to the old files and can copy them to the right path. that's it

[ChrisStankevitz]

JMachieJr wrote:

You keep saying you have a "snapshot" but a VMware snapshot is not a copy of the VM.

JM,

Thank you for your help.  I have a copy of every file that made up the VM at the time the "VMWare Snapsnot" existed.  This includes all vmdk/vmsd/vmxf/vswp/lck/nvram/etc files.  This is accomplished by using the "ZFS snapshot" command -- which unfortunately has the same name as a "VMWare snapshot" but means something different.  A ZFS filesystem snapshot is a way to very quickly and cheaply make a copy of an entire filesystem (in this case the VMWare datastore).

I hope that clears things up.

Again, my backup strategy is:

1. Take a backup "VMWare Snapshot" of all my VMs

2. Take a "ZFS Snapsnot" of the datastore -- giving me a copy of all the vmdk/vmsd/vmxf/vswp/lck/nvram/etc files.

3. Delete the "VMWare snapshots"

And then if I ever need to restore:

4. Fetch the vmdk/vmsd/vmxf/vswp/lck/nvram/etc files from a copy of the datastore in the past, which holds all of my VMs along with the "VMWare Snapshots" they had at the time.

I hope that is clear,

Chris

[ChrisStankevitz]

Ray Afandiyev wrote:

Hi Chris - do the following

1. Clone your current VM (don't power it on) and then get rid of all drives (vmdk) except the system drive.

2. Now mount all vmdk from the snapshot where you have file which you want to restore. Of course you need to get this snapshot on the datastore connected to the host.

3. Then remove the NIC from the cloned VM and power it on. Most probably it will load normally and you will see the previous state and the desired file.

4. Now the trick is to copy this file to the original VM. Therefore add new drive to the cloned VM.

5. Format the new disk and copy the desired file

6. Unmount drive from cloned VM and mount it to original VM. Copy it.

Easy 🙂

Ray,

Thank you.  I like your comment about the removed NIC -- as it shows you are synced up with me as far as what I am trying to accomplish.  I don't like that in step 1 you assume that the original VM is powered down, because ideally it would not be powered down.

Isn't it possible to replace your steps 1 and 2 with this step: "Copy your original backed-up VM (including all it's VMDK/etc files) to the current live datastore, but rename the directory so that it doesn't conflict with the current live VM.  Then add the restored VM to inventory (which may be a problem because it has the same name as the current live VM?)"

At this point I'm not sure if the renamed VM will be "on" or "off".  Certainly it was on when the VMDK/etc files were copied.  And I'm not sure what repurcussions that will have with respect to removing the NIC.

Thank you,

Chris

[ChrisStankevitz]

bharathl wrote:

Chris, You can try following the steps mentioned by Ray or you can simply attach the vmdk file(add as an existing disk) from your clone to the same VM or a test VM and Windows might automatically detect it as its formatted with NTFS and assigns a drive letter. You can simply copy the file and remove the disk after that.

Brilliant!  In my case it might be slightly more complicated since my drive is actually spanned over two vmdk files, but I like this idea.

Thank you,

Chris

[IIIusion · Accepted solution]

Hi Chris,

Please read my instruction carefully:

1. Clone your current VM. Original VM can be online - just right-click and clone it. (Don't power on the cloned VM) and then get rid of all drives (vmdk) except the system drive.

2. Now mount all vmdk from the snapshot where you have file which you want to restore. Of course you need to get this snapshot on the datastore connected to the host.

3. Then remove the NIC from the cloned VM and power it on. Most probably it will load normally and you will see the previous state and the desired file.

4. Now the trick is to copy this file to the original VM. Therefore add new drive to the cloned VM.

5. Format the new disk and copy the desired file

6. Unmount drive from cloned VM and mount it to original VM. Copy it.

And bharathl will not work because you have SPANNED volume across few vmdks. Therefore you need cloned VM with same config as Original VM.

[ChrisStankevitz]

Ray Afandiyev wrote:

Please read my instruction carefully:

Got it, TY.

Chris

[bharathl]

Actually it works. I have tested it on Windows 7 and added both the disks which are part of spanned volume to a test VM and it detected them as foreign disks and given me an option to import it. I then selected both the disks and it successfully imported the configuration and I can access all the data once the drive is created.