Page 1 of 1
Recover IMG files HELP!!!!
Posted: Sun Jul 26, 2026 6:28 pm
by FireMedic
I desperately need help recovering img files. I had a 2-node heartbeat HA on Hyper-V. (Last time I talked to SW support they recommended heartbeat over node majority + SMB witness). I've recently had problems with both nodes being offline for updates and the SW vsan staying offline/unsynchronized when they came back up. This weekend, I figured I would migrate to Node Majority + SMB Witness.
Removed the HA and ran the CreateHASMBWitness powershell script. After dealing with several problems in the script (kept giving an error regarding a 2MB minimum size), and duplicate files. I ended up making a two copies of the original img file, renaming the old headers, deleting the img file from the partner node (HV2), and eventually got the script to run and sync the img from HV1 to HV2. All seemed well. Connected iscsi and Windows shows the iscsi drive but only sees it as RAW. I cannot get it to see the partitions so get the original data!
I have fighting this since Friday evening and have to have this back up before Monday morning.
I have mounted the img files in imgdisk but it can't see the partitions either. Currently running testdisk (per Grok's advice) and it is about 25% through the 2.5TB img and shows some partitions.
I have Veeam backups of the two critical VMs on here and have started recovery of those but will need to manually rebuild a few lesser important VMs. The data seems to be in the img files but I need Windows to see the partions!
Re: Recover IMG files HELP!!!!
Posted: Sun Jul 26, 2026 6:49 pm
by yaroslav (staff)
Node majority, in general, shuts down the only active node when two remaining nodes are down. That node "thinks" that it is isolated and becomes unsynchronized. In your case, there might be a situation where Witness was unreachable, and another node got restarted.
First things first: we don't help to recover file systems. Also, messing around with the headers is dangerous.
On the other hand, the very fact that there's RAW is already promising. It means that the source image used to have some file system. Did you have that volume as a CSV? You need to override the disk reservations if so
https://learn.microsoft.com/en-us/power ... ver2025-ps.
p.s. Make sure to have solid backups.
p.p.s. For faster service, consider getting a commercial key + premium support contract.
Re: Recover IMG files HELP!!!!
Posted: Sun Jul 26, 2026 8:11 pm
by FireMedic
I did submit a ticket but not sure it includes weekend support.
Yes that volume was connected via iscsci and a CSV was mounted on top of it. Should I not be expecting a partition if a CSV was mounted to it?
Re: Recover IMG files HELP!!!!
Posted: Sun Jul 26, 2026 9:16 pm
by FireMedic
I really appreciate you replying on a weekend! I'm just trying to reattach the existing img file to a new standalone target/device. Since I copied the img file before trying to rebuild the HA device, I kinda doubt all three copies got corrupted. I've tried letting it create new header files.
Here's one of the original header files from HV2 from when I created the vSAN a year ago
Code: Select all
<?xml version="1.0" encoding="UTF-8"?>
<header signature="StarWind" version="1.2" path_backup="My computer\E\vSAN\vSANVM2\vSANVM2.swdsk.bak">
<device active="true" plugin="imagefile" name="imagefile">
<storages>
<storage id="1" type="device" name="imagefile" lun="0x0">
<interval size="2634" units="GB"/>
<inquiry>
<serial_id>704754D440DD2A1A</serial_id>
<vendor id="STARWIND"/>
<product id="STARWIND " revision="0001"/>
<eui_64>704754D440DD2A1A</eui_64>
<max_unmap size="128"/>
</inquiry>
<geometry>
<sector size="512" psize="4096"/>
<track sectors="16"/>
<cylinder tracks="32" count="65535"/>
</geometry>
</storage>
</storages>
</device>
<system>
<resources>
<storages>
<storage id="1" name="My computer\E\vSAN\vSANVM2\vSANVM2.img" type="file">
<interval size="2634" units="GB"/>
</storage>
</storages>
<network/>
</resources>
</system>
<node id="1" name="imagefile" shut="false" active="true">
<storages>
<storage_ref id="1"/>
</storages>
</node>
</header>
Here's what starwind iscsi disk showing RAW.
Code: Select all
PS E:\> get-disk
Number Friendly Name Serial Number HealthStatus OperationalStatus Total Size Partition
Style
------ ------------- ------------- ------------ ----------------- ---------- ----------
0 AMD-RAID A... 0000d47a96546f80 Healthy Online 446.62 GB GPT
3 vSANDisk1 {6ff89e04-d689-4fd3-9e5a-5fdf... Healthy Online 3.5 TB GPT
4 STARWIND S... D6B14E781C4B148F Healthy Online 2.57 TB RAW
I've tried mounting the original and the two backup copies of the img file using ImDisk and OSFMount and neither will show any partitions. TestDisk is currently scanning but shows the partitions in the img file.
Code: Select all
TestDisk 7.3-WIP, Data Recovery Utility, September 2025
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org Analyse cylinder 20084/76496: 26% Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)
MS Data 32768 5523898327 5523865560 [CSV-VMs2]
MS Data 190552 2097305687 2097115136
EFI System 989184 1193983 204800 [EFI System Partition] [NO NAME]
MS Data 1226752 125040639 123813888
MS Data 123269121 125040640 1771520
MS Data 125040640 126812159 1771520
MS Data 1226752 126814207 125587456
MS Data 126814207 252401662 125587456
Mac HFS 313093691 313260791 167101 [c~Es@M-uM-q~O9q@X ^\M-*js@]
Re: Recover IMG files HELP!!!!
Posted: Sun Jul 26, 2026 11:01 pm
by yaroslav (staff)
Thanks for the additional info.
If it was CSV and its cluster was recreated, try overriding the reservation.