Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The worst possible situation...

Despite my vigilence doing backups, and trying to keep my PC secure, one of my VMs disk seems to be wiped out. Using the VHD tool from R1Soft (HyperV VHD Explorer), when I attach the VHD, it says no volumes found so it looks like something wiped out the VHD (which it still its original size).

It seems that something has sneaked through whatever security I have/had and has wreaked havoc.

Can I recover anything from this?

share|improve this question
add comment

3 Answers

Can I recover anything from this?

Yes, everything from your latest backup.

If that's not an option, I suggest "acquiring" a copy of R-Studio's data recovery toolset (the network edition) and opening the VHD as an image file. I do not think R-Studio has native support for VHD but let it run a scan over the image and see what it can detect.

share|improve this answer
add comment

Have you tried using disk management in Windows 7 to mount the VHD? If it mounts, run a chkdsk on the mounted volume. (Make a backup of the VHD first)

How to mount using disk management http://kb.acronis.com/content/3504

How to unmount when done http://serverfault.com/questions/126377/how-to-unmount-a-vhd-in-windows-7-there-is-no-unmount-option

Some say they have retrieved data using VMWare Converter to convert the VM

http://serverfault.com/questions/34201/vhd-file-structure-repair-corrupted-vhd

http://downloads.vmware.com/d/info/datacenter_downloads/vmware_vcenter_converter_standalone/4_0

Also, you can try this software to mount the image http://www.winimage.com/

.

share|improve this answer
add comment

make a copy of the VHD, mount it with whatever you use to mount a VHD, then run testdisk on it. It SHOULD, if there's any of the old FS structure left, detect and be able to recovery it.

I'd note tho whatever 'it' is may not be a virus, it could be anything from a bad shutdown, to the programme running the volume shutting down non cleanly.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.