The Customer
A local German IT service contractor, HMR Systemhaus GmbH, received a call from a tax consultancy firm about an important virtual machine (VM) that was not running anymore.
The Situation
This virtual machine which contained a critical application and SQL database. The VM was hosted on a server with a RAID 5 array running VMware ESX 7.01. When the contractor examined the VMFS datastore, only the 500GB snapshot was present, the main VM base file was missing. Unfortunately, the client was unable to restore from backup and without access to their DATEV Application the entire company came to a full stop.
The Solution
After noting the critical nature of the project, Ontrack’s data recovery experts proceeded with EMERGENCY data recovery services to restore the missing data. This three-step process is outlined below:
1. Consultation
The Ontrack team was able to immediately join the contractor’s and client’s teams to scope the data loss event and the storage systems impacted. Based on the discussions, Ontrack was able to design a data recovery project plan, including timing expectations and costs for the recovery.
2. Evaluation
The customer packaged and delivered 4 Seagate 1.2TB (ST1200MM0129) hard drives to the Ontrack team from their server. After checking in the drives, Ontrack’s data recovery engineers used proprietary tools to image and then analyze the disks, virtually rebuild the RAID5 array, rebuild the volume and file system, and scan for deleted virtual disk fragments in the unallocated space.
3. Data Recovery
Using the scan results, the Ontrack team was able to virtually rebuild the deleted virtual disk. Upon further analysis, an NTFS volume was located inside the virtual machine which contained the missing application and SQL database. This recovered base “flat file” was merged with the 500GB existing Snapshot file to access the newest data. Quality scans of the data were run with nearly 100% of the customer files passing the integrity and signature checks. Only the Microsoft SQL database files showed some integrity errors. The Ontrack team generated reports of the recoverable data and upon approval, extracted the data from the rebuilt virtual disk. Additional work was performed to extract the tables and rows from the SQL database.
The recovered file data was transferred to an encrypted external hard drive along with the extracted SQL data. The data was delivered to the customer and was copied into their production environment.
The Resolution
During the consultation, the customer explained the urgency and impact of the data loss. The customer further shared that they had initially turned to another data recovery company that after two weeks was unable to recover the missing data. After the consultation with Ontrack, the customer hired a courier to pick up their media directly from the other company and take it halfway across Germany to the Ontrack lab in Boeblingen. It took Ontrack only three days to recover all the missing data being ready right before Christmas!
Regarding the damage to the SQL database, it is likely the result of the sudden shutdown of the VM. Often in cases of a sudden hardware failure, deletions, malware or ransomware attacks or a server power issue open databases are not closed properly and transactions may be improperly written. Often the software vendor will need to assist with the restoration of the application using the recovered database. In this case the DATEV service technicians from the manufacturer of the accounting and tax software, were able to clean up all 135 databases recovered by the Ontrack and restore 99% of the original data in the production environment allowing the company to continue operations.
Learn more about our Virtual Server, Server and Database Data Recovery services and solutions or Contact Us if you have a Data Recovery project that we can help you with.
Hong Kong | English
Locations
Search
Back to listing
