A virtual machine is a nesting doll: a guest file system, inside a container file, inside a datastore, on top of physical disks. When one shell cracks, the machine vanishes as a whole — but the recovery is never about the whole. It’s about identifying which layer failed and mending exactly that one, with the layers beneath it imaged and safe before a single repair begins.
Bottom layer: the datastore — VMFS on a dead RAID, a Hyper-V volume that lost its host, NFS storage that went away mid-write. That’s array and file-system work first, and the VMs come along as cargo. Middle layer: the container — a VMDK deleted in a cleanup, a VHDX corrupted by a host crash, a qcow2 truncated by a full disk. Top layer: the guest inside — the virtual Windows or Linux system whose own NTFS or ext4 took the damage.
Each layer has its own failure modes and its own fixes, and misdiagnosing the layer is how DIY attempts turn one problem into three.
Snapshots are the quiet complication. Every checkpoint splits the machine across another delta file, and the “current” VM only exists as the whole chain read in order. Delete a link, consolidate at the wrong moment, or crash mid-merge, and the machine fractures into parents and orphans that no hypervisor will marry back together. We rebuild the chain manually from the deltas’ own metadata — and where a link is genuinely gone, we recover to the newest state the surviving chain supports and say so plainly.
If a consolidation is stuck right now: stop retrying it. Each attempt rewrites deltas the reconstruction needs.
Deleted VMs are their own genre — removed from inventory with “delete from disk” ticked, swept by a storage cleanup, or lost when a datastore was reformatted for the new cluster. On VMFS especially, deletion leaves the container’s blocks recoverable until fresh provisioning claims them, so the clock is the enemy: freeze the datastore, provision nothing new onto it, and get an image to the bench. Whole machines come back this way more often than administrators expect.
Because no two of these jobs are the same shape or size, the price is quoted to the job — individually, in writing, after the free assessment and before any paid work begins. Every job starts with a free diagnostic and ends the same way it was quoted: the figure goes in writing before a single sector is read, and on most jobs there is nothing to pay unless your data comes back. No hourly meter, no surprise “evaluation fee”, no percentage of what the files are worth.
Frequently not — the deletion removed the pointers, and the VMDK’s blocks persist until new machines are provisioned over them. Freeze the datastore immediately: no new VMs, no storage vMotion onto it, no cleanup jobs. From an image of the LUN we carve the containers back and remount the guest inside.
Usually — a crash mid-write leaves the container’s internal structures inconsistent, and Hyper-V refuses the whole file rather than risk it. We repair the VHDX structures against a copy, or bypass the container entirely and rebuild the guest file system from the raw data inside. Avoid the “inspect and repair” retries; they write.
The out-of-date boot means the hypervisor fell back to a parent disk, abandoning the deltas that held your recent months. Those deltas are the recovery target — do not delete them as “orphans”. We reconstruct the chain from their metadata and roll the machine forward to the newest consistent point the files allow.
Yes — often that’s the smarter deliverable. We open the recovered container, mount the guest file system read-only and extract the documents, databases or mail stores you actually need, skipping the operating system entirely. You choose at assessment time: whole machines, files only, or both.
Two honest routes, no vans. Hand the device in at Tay House, 300 Bath Street — right at Charing Cross, two minutes off the M8 — Monday to Friday, 9am–5:30pm. Or wrap it well and send it by insured, tracked post from Paisley, Ayrshire, the Highlands or anywhere else in the UK. Either way the work is done in-house by our own engineers, with a documented chain of custody, and your data never leaves the UK.
Stop provisioning, stop consolidating, and tell us which layer cracked — the free assessment does the rest — virtual machine recovery is priced from £800 + VAT, fixed in writing before any work. Virtual machine recovery for Glasgow: VMware, Hyper-V and the rest, rebuilt from the disks up and delivered ready to run.