Recover IMG files HELP!!!!

[FireMedic]

I desperately need help recovering img files. I had a 2-node heartbeat HA on Hyper-V. (Last time I talked to SW support they recommended heartbeat over node majority + SMB witness). I've recently had problems with both nodes being offline for updates and the SW vsan staying offline/unsynchronized when they came back up. This weekend, I figured I would migrate to Node Majority + SMB Witness.
Removed the HA and ran the CreateHASMBWitness powershell script. After dealing with several problems in the script (kept giving an error regarding a 2MB minimum size), and duplicate files. I ended up making a two copies of the original img file, renaming the old headers, deleting the img file from the partner node (HV2), and eventually got the script to run and sync the img from HV1 to HV2. All seemed well. Connected iscsi and Windows shows the iscsi drive but only sees it as RAW. I cannot get it to see the partitions so get the original data!
I have fighting this since Friday evening and have to have this back up before Monday morning.
I have mounted the img files in imgdisk but it can't see the partitions either. Currently running testdisk (per Grok's advice) and it is about 25% through the 2.5TB img and shows some partitions.
I have Veeam backups of the two critical VMs on here and have started recovery of those but will need to manually rebuild a few lesser important VMs. The data seems to be in the img files but I need Windows to see the partions!

[yaroslav (staff)]

Node majority, in general, shuts down the only active node when two remaining nodes are down. That node "thinks" that it is isolated and becomes unsynchronized. In your case, there might be a situation where Witness was unreachable, and another node got restarted.
First things first: we don't help to recover file systems. Also, messing around with the headers is dangerous.
On the other hand, the very fact that there's RAW is already promising. It means that the source image used to have some file system. Did you have that volume as a CSV? You need to override the disk reservations if so https://learn.microsoft.com/en-us/power ... ver2025-ps.
p.s. Make sure to have solid backups.
p.p.s. For faster service, consider getting a commercial key + premium support contract.

[FireMedic]

I did submit a ticket but not sure it includes weekend support.
Yes that volume was connected via iscsci and a CSV was mounted on top of it. Should I not be expecting a partition if a CSV was mounted to it?

[FireMedic]

I really appreciate you replying on a weekend! I'm just trying to reattach the existing img file to a new standalone target/device. Since I copied the img file before trying to rebuild the HA device, I kinda doubt all three copies got corrupted. I've tried letting it create new header files.

Here's one of the original header files from HV2 from when I created the vSAN a year ago

Code: Select all

<?xml version="1.0" encoding="UTF-8"?>
<header signature="StarWind" version="1.2" path_backup="My computer\E\vSAN\vSANVM2\vSANVM2.swdsk.bak">
  <device active="true" plugin="imagefile" name="imagefile">
    <storages>
      <storage id="1" type="device" name="imagefile" lun="0x0">
        <interval size="2634" units="GB"/>
        <inquiry>
          <serial_id>704754D440DD2A1A</serial_id>
          <vendor id="STARWIND"/>
          <product id="STARWIND        " revision="0001"/>
          <eui_64>704754D440DD2A1A</eui_64>
          <max_unmap size="128"/>
        </inquiry>
        <geometry>
          <sector size="512" psize="4096"/>
          <track sectors="16"/>
          <cylinder tracks="32" count="65535"/>
        </geometry>
      </storage>
    </storages>
  </device>
  <system>
    <resources>
      <storages>
        <storage id="1" name="My computer\E\vSAN\vSANVM2\vSANVM2.img" type="file">
          <interval size="2634" units="GB"/>
        </storage>
      </storages>
      <network/>
    </resources>
  </system>
  <node id="1" name="imagefile" shut="false" active="true">
    <storages>
      <storage_ref id="1"/>
    </storages>
  </node>
</header>

Here's what starwind iscsi disk showing RAW.

Code: Select all

PS E:\> get-disk

Number Friendly Name Serial Number                    HealthStatus         OperationalStatus      Total Size Partition
                                                                                                             Style
------ ------------- -------------                    ------------         -----------------      ---------- ----------
0      AMD-RAID A... 0000d47a96546f80                 Healthy              Online                  446.62 GB GPT
3      vSANDisk1     {6ff89e04-d689-4fd3-9e5a-5fdf... Healthy              Online                     3.5 TB GPT
4      STARWIND S... D6B14E781C4B148F                 Healthy              Online                    2.57 TB RAW

I've tried mounting the original and the two backup copies of the img file using ImDisk and OSFMount and neither will show any partitions. TestDisk is currently scanning but shows the partitions in the img file.

Code: Select all

TestDisk 7.3-WIP, Data Recovery Utility, September 2025                                                                 
Christophe GRENIER <grenier@cgsecurity.org>                                                                             
https://www.cgsecurity.org                                                                                                                                                                                                                                                                                                                                              Analyse cylinder 20084/76496: 26%                                                                                                                                                                                                                                                                                                                                       Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)                                                  
Warning: number of bytes per sector mismatches 4096 (NTFS) != 512 (HD)                                                    
MS Data                    32768 5523898327 5523865560 [CSV-VMs2]                                                       
MS Data                   190552 2097305687 2097115136                                                                  
EFI System                989184    1193983     204800 [EFI System Partition] [NO NAME]                                 
MS Data                  1226752  125040639  123813888                                                                  
MS Data                123269121  125040640    1771520                                                                  
MS Data                125040640  126812159    1771520                                                                  
MS Data                  1226752  126814207  125587456                                                                  
MS Data                126814207  252401662  125587456                                                                  
Mac HFS                313093691  313260791     167101 [c~Es@M-uM-q~O9q@X ^\M-*js@]                                                                                                                                                                                                                      

[yaroslav (staff)]

Thanks for the additional info.
If it was CSV and its cluster was recreated, try overriding the reservation.