How to recover deleted files from a VMDK or QCOW2 virtual machine disk

Step by step

1. Stop the virtual machine

   Shut the guest down cleanly or power it off; do not suspend it and keep working in it. A running guest keeps writing logs, updates and swap data into the virtual disk, and every write can land on the space your deleted files occupy.

2. Copy the VM folder

   Copy the folder that holds the virtual disk to another physical drive. For VMware this is the small descriptor .vmdk plus its extent files such as name-flat.vmdk or name-s001.vmdk; for QEMU or KVM it is usually a single .qcow2 file. Work on the copy, so the original stays untouched.

3. Keep extents next to the descriptor

   A VMDK descriptor is a short text file that lists its extent files by name. Those files must sit in the same folder with their original names, or the disk cannot be assembled. If you downloaded the disk from a datastore, make sure both the descriptor and the large data file arrived.

4. Open the virtual disk

   In FileFix Ultimate, open Deleted file recovery, choose Disk image file and click Open image file. Select the descriptor .vmdk or the .qcow2 file. The disk is opened read-only and its partitions are listed like those of a physical drive.

5. Scan the guest partition

   Pick the partition that held the files, usually the large NTFS volume for a Windows guest or the ext4 root or home volume for Linux, and start the Balanced scan. If no file system is recognised, the Deep signature scan still searches for known file types.

6. Save to the host

   Preview the results, select what you need and save it to a folder on the host or another disk. Check the status labels; files marked validated passed an independent format check.

Which virtual disk formats open, and how they differ

VMware disks come in several layouts. A monolithic sparse VMDK grows as the guest writes data. A streamOptimized VMDK is a compressed variant often found inside OVA and OVF exports. A flat VMDK is a preallocated raw file described by a separate small descriptor. FileFix Ultimate reads all three, as well as QCOW2 version 2 and 3 files from QEMU, KVM and Proxmox, VHD and VHDX from Hyper-V, and raw .img files.

For sparse and QCOW2 disks, areas the guest never wrote are not stored in the file at all. That keeps the files small, but it also means that a block the guest released and the host reclaimed may simply no longer exist.

Snapshots, thin disks and TRIM inside the guest

When a VM has snapshots, newer changes live in delta files next to the base disk. Opening only the base file shows the guest as it was when the snapshot was taken, which can actually help if the files were deleted later. If you need the latest state, the simplest route is usually to consolidate a copy of the VM in your hypervisor first and then open the result.

Modern guests can send TRIM or unmap commands for deleted space, and some hypervisors then shrink thin or sparse disks. If that happened, the deleted blocks may be gone from the file, just as on an SSD. Recovery tends to work best on thick or flat disks and on guests where space reclamation is off.

Common mistakes

Booting the VM to install a recovery program inside it writes to the very disk you want to recover. Running a hypervisor repair or compact command on the original disk can also discard free space. Opening the descriptor after renaming its extent files breaks the link between them; rename nothing and keep the folder structure intact.

When it won't work

• Encrypted virtual machines cannot be read without the hypervisor's decryption; BitLocker inside the guest needs its recovery key.
• Guests using unsupported file systems such as ReFS, Btrfs or ZFS can only be searched by file signature, without names or folders.
• If a missing or renamed extent file leaves part of the disk absent, files stored in that part cannot be recovered.
• Space the guest trimmed and the host reclaimed from a thin or sparse disk usually no longer holds the old data.
• A snapshot (child) VMDK that needs its parent disk, seSparse and vmfsSparse disks, and raw device mappings cannot be opened. Use the base disk, or consolidate the snapshots in your hypervisor first.

How FileFix Ultimate helps

• Opens VMDK (sparse, streamOptimized and flat), QCOW2 v2 and v3, VHD, VHDX, E01 and raw images read-only.
• Lists the partitions inside the virtual disk and reads NTFS, FAT32, exFAT and ext2, ext3 and ext4 guests to recover names and folders.
• Falls back to signature search for 68 file types when the guest file system is not recognised.
• Can combine several disk images, including VMDK files, into a virtual RAID 0, 1, 5 or JBOD.

Frequently asked questions