Faulty SSD memory lets a virtual machine disappear in a new vSAN system.

Since March 2014 VMware’s vSAN offers the option for vSphere EXSi servers to organise and manage storages. A vSAN system combines applications or data saved in virtual machines in a joint, clustered Shared Storage Datastore. All connected host computers and their hard drives are part of this joint data-store. This means that in the event of a hardware-fault or data-loss, the data-rescue engineers need to deal with an additional information level.

To recover the vSAN system and the virtual machines, we developed new software tools to find the description and log-files necessary for the identification and assembly of data. The data-stores were functioning as containers, so we first needed to identify the links to the contained virtual machines and then reconstruct them in the next step. Thanks to the new tools we were able to get information about how the virtual machines were saved in the vSAN’s data-store and distributed to the affected hard drives. This allowed us to find the necessary description and log-files much faster, making the recovery process significantly easier.