ReclaiMe Data Recovery Training
Useful Tips in Data Recovery

Case Study 3 - Data recovery from a NetGear NAS used as ESX datastore

The recent trend is virtualization which is used not only at the enterprise level but in home systems as well. Often home users come with the configurations where a NAS device is used as a virtual machine datastore. Let's discuss the specifics of data recovery from such systems.

The first thing that is important to know when dealing with such systems is that they are complex and multilevel meaning that the recovery is also multistage.

So, there is a NAS device, let it be NetGear ReadyNAS NV+v2 of four 2TB disks.

When setting up the NAS, a user should select a RAID array level according to which disks are combined into a single storage and typically it is a RAID5. As for the filesystem type, it is btrfs which is preset in all modern NetGear NASes.

Next, a user should create a share folder for ESX on the RAID array. At the logical level this looks like creating folders and files on the btrfs filesystem, which in turn is on the RAID5 created over member disks.

Further ESX share is used as a datastore for a virtual volume. At the logical level it looks like a new filesystem that a user chose (in our example it is NTFS) that in turn is stored as a file on the btrfs filesystem.

So, there are several layers:

  • layer at which physical disks are combined into a RAID array using MD and LVM technology,
  • layer at which ESX share is created - a special file stored on the filesystem of the NAS device (in our case it is btrfs),
  • layer at which a virtual volume is created - virtual environment filesystem (in our case it is NTFS).

You should start the recovery from the physical disks level moving gradually to the virtual environment level.

RAID recovery

Usually, in such systems MD and LVM metadata is correct and ReclaiMe Pro can read it at the start – just do not forget to check md-raid and LVM. In the case of NetGear and Synology it is important to check BTRFS as well, since BTRFS is not only a filesystem but also a disk space driver that builds a virtual volume using MD/LVM components. If metadata is not damaged, you see a BTRFS volume in the Disk and Partition list window of ReclaiMe Pro. If there is no volume or the volume size is incorrect, you need to do a full-scale recovery of RAID configuration. You should start with the RAID analysis and then either rebuild RAID manually or automatically. After that you should work with the RAID xml file.

ESX datastore extraction

Run BTRFS filesystem recovery on the BTRFS volume and wait till the end of the scan. It is important to wait that long so that ReclaiMe Pro can find and analyze all the extents of the file. Since each data modification inside the virtual machine leads to the modification of some file fragments, as a result, there are millions of BTRFS extents even for a datastore file which is not often used. Given that BTRFS is a copy-on-write filesystem, the number of the extents becomes unbelievable due to the extents of different generations. To find all possible extents, the software needs to scan the whole volume.

Save the file containing the virtual machine content to a prepared location. You need to prepare free disk space equal to the size of the ESX share.

Extracting files stored on the virtual machine

Upload the file you just saved to ReclaiMe Pro as image file at start and click Proceed.

Scan a found partition and save the data.

You need free space equal to the size of the files you need to recover.

We have a mailing list in which we talk about interesting cases we encounter and share some tips and tricks.