Deleted a Virtual Machine? Your Recovery Options

Deleting a virtual machine can mean removing it from the management console, removing its configuration, or deleting its disk files as well. The consequences are very different, and it is often possible to recover from the milder cases without any specialist help. The first job is to establish exactly what was removed.

In VMware, removing a virtual machine from the inventory only removes it from the list, and its files stay on the datastore, so it can be added back by browsing the datastore and registering it again. Deleting it from disk removes the files. In Hyper-V, removing a virtual machine in Hyper-V Manager removes its configuration but leaves the virtual hard disk files in place, and a new virtual machine can be created and attached to the existing disk.

If the files really were deleted, the space they occupied is now marked as free, but the data is usually still there until something overwrites it. New virtual machines, snapshots, growing thin-provisioned disks, and even log files all write to the same storage. Avoid creating or moving anything on that datastore or volume, and pause activity where possible, until you know the position.

Check for backups, replicas and snapshots before anything else, including any taken by the storage system itself, since a snapshot at the storage level can hold a complete earlier version of the datastore. Backup software may be able to restore the virtual machine directly, and a copy on another host is also worth looking for. These routes do not put the original storage at further risk.

Do not reformat the datastore or the volume, and do not try to rebuild the datastore in place. Avoid running repair operations on the file system, which write to the storage. Copying other virtual machines off the same datastore is reasonable, but do it in a way that does not add large amounts of new data to the same place.

If the disk files were deleted, the outcome depends on how much of the space has been reused and on how the disks were laid out. Thin-provisioned and heavily fragmented disks are harder to reassemble, and any overwritten portion is lost. A virtual disk that is only partly recovered can still yield a great deal of usable data from inside it, but there is no way to know in advance.

If the machine mattered and the files were deleted rather than just removed from the inventory, a specialist assessment before further activity on the storage gives the best chance. We have solved many cases like this; contact us for a free assessment.