Hey all,
We had the VMWare folders hosting our virtual files accidentally deleted while the server was running.
We did not have a backup.
Fortunately, we were running Reiser-FS so we attempted a reiserfsck --rebuild-tree.
It found most, but not all, of our missing files easily. Except for the NT4 server (don't laugh) vmdk file. VMDK for the snapshots were intact, just the primary one was bad.
I managed to re-create it based on information from the forum. (see attached)
The next issue I had was that the base image was smaller than the snapshot - and nobody knows why (it was short around 1.7 MB). The previous logs that were archived indicate that the snapshot size _should_ be correct, but the base image do not match. After some experimentation, I edited the vmdk of the snapshot to have the sector numbers match the base image's new one, fixed the CID's, and then the VM managed to start. Lord only knows what this did to my snapshot.
The next issue was that the NTFS partition was corrupt. Got error messages regarding ntoskrnl.exe. In my experience, chkdsk needed to be run. This being NT4 Server, and my ERDs being long missing - I tried an XP install disk and ran chkdsk. It did not find the NTFS partition.
Turned out the partition table was bad. Mounted a troubleshooting CD and ran TestDisk to fix the partition table. After this was done, ran the XP install disk and went to recovery console. Ran chkdsk /r twice, and my NTFS partition began to work again - bootex.log contains some things but no showstoppers.
As it stands, original partition table appears to be a primary DOS partition formatted FAT as boot partition, and then a logical partition formatted NTFS 1.2 inside a extended partition, as system.
At this point I can do data recovery from the NTFS partition - for example, mounting the vmdk's using vmware-mount. I can even see the most recend edited files of last week.
--------------
However - it is not booting into Windows.
*** STOP: 0x0000007B (0xF2413BE0, 0xC0000034, 0x00000000, 0x00000000)
INACCESSIBLE_BOOT_DEVICE
CPUID:GenuineIntel 6.c.2 irql:0 SYSVER: 0xf0000565
Dll Base DateStmp - Name
80100000 416a9b06 - ntoskrnl.exe
80008000 36c4a0ae - Disk.sys
801f0000 373b4331 - Ftdisk.sys
80206000 36e5f31c - intlfxsr.sys
80010000 36c49893 - hal.dll
8000c000 375704e5 - CLASS2.SYS
801f8000 4431a335 - stcp2v30.sys
80208000 37c5705c - Ntfs.sys
If I run NT4 /sos, then I see it load the following drivers before BSOD'ing.
D:\WINNT\System32\ntoskrnl.exe
D:\WINNT\System32\hal.dll
D:\WINNT\System32\config\system
D:\WINNT\System32\config\system.alt
D:\WINNT\System32\c_1252.nls
D:\WINNT\System32\c_437.nls
D:\WINNT\System32\l_intl.nls
D:\WINNT\FONTS\fgaoem.fon
D:\WINNT\System32\DRIVERS\atapi.sys
D:\WINNT\System32\DRIVERS\SCSIPORT.SYS
D:\WINNT\System32\DRIVERS\buslogic.sys
D:\WINNT\System32\DRIVERS\SCSIPORT.SYS
D:\WINNT\System32\drivers\aic78u2.sys
D:\WINNT\System32\drivers\SCSIPORT.sus
D:\WINNT\System32\Drivers\Disk.sys
D:\WINNT\System32\Drivers\CLASS2.sys
D:\WINNT\System32\Drivers\Ftdisk.sys
D:\WINNT\System32\drivers\stcp2v30.sys
D:\WINNT\System32\Drivers\intlfxsr.sys
D:\WINNT\System32\Drivers\Ntfs.sys
Technically, no drivers have changed, so I don't need to insert the VMWare SCSI drivers or anything. Every NTFS checker program I know says the filesystem passes muster.
Any ideas? Advice? We learned our lesson on backups... I feel like I missed something important. Can I write the snapshot + base image out to a new clone image when the VMDK sector numbers don't match?
Below are copies of my vmdk files, the most recent successful log, and a directory tree. Filenames have been changed.
- Greg