VMFS Recovery

Recovers data from ESX server

VMFS metadata files

Sometimes we come across a situation when some free space from a newly created VMFS data store is missing. This is explained by availability of hidden system files, comprised in the root of any VMFS volume. These files are recognized by the following indicators: all of them start with the dot and have .sf extension. They serve as files' indexes and descriptors on the VM file system, being in essence, the mapping information for virtual machine files, directories, symbolic links, RDM descriptor files, etc. This mapping information is described with a term metadata.

Thus when a new VMFS volume is created, you have to take into account, that a certain amount of the disk space will be consumed by metadata. This potential space partly depends on the LUN size, which, in its turn, is dependent on other parameters. So, the recommended value for metadata space you should use while sizing your data stores is 1200 MB per LUN (regardless of the LUN size).

Metadata files occupy more space in the case of a small block size because of the more addresses and less space, if the block size is big. They may slightly grow over time. These files are created when the VMFS volume is first set up and can neither be changed nor deleted. Though metadata can be updated.

It is updated every time the following VM management operations are performed:

  • powering virtual machine on and off,
  • creating or locking a VM file,
  • changing a file's attributes,
  • creating or deleting a VMFS datastore,
  • expanding a VMFS datastore,
  • creating a template,
  • deploying a virtual machine from a template,
  • migrating a virtual machine with vMotion.

To avoid metadata changes VMFS uses special locking mechanisms.

All disk space under VMFS-3 is organized according to four resource types. They are : blocks, sub-blocks, pointer blocks, and file descriptors. Resources are grouped into clusters, which form cluster groups. Every resource type is administered by one or a number of system files. Lets have a look at what those abbreviated file names stand for:

  • fbb.sf = file block bitmap.sf
  • fdc.sf = file descriptor cluster.sf
  • pbc.sf = pointer block cluster.sf
  • sbc.sf = sub-block cluster.sf
  • vh.sf = volume header.sf
  • sdd.sf = scsi device description.sf

The VMFS-5 uses one more system file:

  • pb2.sf = pointer block 2.sf

Metadata plays a crucial role in data recovery process. Basic undeleting algorithms detect metadata and export it to a recovery log file with further restoration of vdmk block addresses. It is highly recommended to backup your metadata files. Most popular backup utilities allow up to 10 versions of your metadata to be saved. Anyway we advise everyone to be active with metadata backup, that will help solving serious data security issues if there are any.