How to Repair a VHDX File That Will Not Mount

A VHDX file is a container: a header, a log, a table that says where each block of the virtual disk lies in the file, and the blocks themselves. When Hyper-V reports that the file is corrupted or unreadable, the damage is usually in the header, the log or the table, a few megabytes out of many gigabytes. VHDX recovery is mostly about getting past those structures to the disk contents.

Copy the VHDX, and every AVHDX file that belongs to it, to another volume before you try anything. Mounting a VHDX read-write replays its log and changes the file; a merge rewrites the parent. If the storage itself is failing, copy once and work only on the copy.

On a Hyper-V host, Test-VHD checks whether the file and its parent chain are usable, and Get-VHD shows the type of the disk, its parent path and its size. Mount-VHD with the ReadOnly switch tries to attach the disk without changing it. The error you get tells you which case you have.

The common cases are a host crash or power loss while the file was being written, a volume that ran full, a checkpoint chain whose parent was moved or renamed, and ransomware that encrypted the beginning of the file.

If the virtual machine had checkpoints, its current state lives in one or more AVHDX files that point to a parent. When the parent path is wrong, the chain breaks and the disk will not mount. Set-VHD with the ParentPath parameter reconnects a child to its parent; it must be the parent the child was created from, in the state it was in then. Do not merge until the chain tests clean, and never merge on the only copy.

Then the container is fine and the damage is inside the virtual disk: a lost partition table or a damaged file system. Work on it read-only. Running CHKDSK on a damaged volume fixes the file system by removing what it cannot understand, so run it only on a copy, and only after the files have been copied out.

If the header or the block table is damaged, Hyper-V has no way to open the file, but the blocks of the virtual disk are still in it. A recovery program reads the VHDX structures itself, follows the checkpoint chain, and shows the partitions and files inside. Partition tables and boot sectors can be restored from their backup copies, and the disk can be saved as one raw image with its checkpoints merged.

After a ransomware attack the same applies: large VHDX files are often encrypted only at the beginning or in stripes, and the file system inside can frequently be rebuilt from what was left alone.