What options do I have to recover data from a virtual environment?
The good news is that there are a great many ways to recover some and, in many cases, all of the lost virtual data. The first point of
entry is at the storage level. It can be possible in some cases to directly recover data from physical drives by taking an image of the
drives and reading whatever raw data might be available on the disk.
The next option is to attempt to recover data from the logical volumes (LUNs) or RAID. If the RAID controller is available, it can be used
to track down the many slices of data spread across virtual disks. By determining what the configuration should be, engineers can
virtually rebuild the array and gain access to the storage. If the RAID controller is corrupted, it may be necessary to emulate the RAID
controller and rebuild what is missing.
The next level up, with each representing a higher degree of recovery difficulty, is the host file system level. In VMware this would be
VMFS and in Hyper-V, NTFS or ReFS. In many cases, data isn't available directly at the storage level. But if the right tools are used,
recovery experts can trace data from the basic storage data blocks, map it to the host level and recompile it.
If that process doesn't provide an adequate recovery, additional tools can be employed to extend further into the guest file system
level. By investigating the virtual file system, data recovery specialists can sometimes find data that would otherwise be lost. Finally, it is
possible to reach into the guest file level and access data lurking in application files such as SQL, Exchange, SharePoint, Oracle, Office
files, ZIP files and more.