Complex VSAN Data Recovered
Jul 7, 2021
The Situation
The VSAN system consisted of three nodes, each with one solid state drive (SSD) and seven hard drives (HDD). The initial drive failure was an SSD on the one of the nodes. The second drive failure was an SSD on a separate node. The 24 drives
appear in the VSAN as individual VMFS data stores. Each Virtual Machine (and snapshot) in this case was comprised of a file level RAID made up of six individual files.
The Solution
The system integrator sent all 24 drives to the Ontrack lab in Singapore via priority shipping. Once received, the drives were imaged and the Ontrack engineers began reassembling the data. The affected Virtual Machine was found to contain three individual virtual disks with between one and four active snapshots each. The virtual disk and snapshot VMDKs were found to be comprised of a mix of file level RAID1s and RAID10s in the VSAN system. Several of the RAID10 VMDKs were found to be degraded. Using proprietary recovery tools, engineers at Ontrack were able to map the VSAN files and rebuild the file level RAIDs, excluding degraded files where appropriate. Once the snapshots were merged, Ontrack was able to recover all of the data for the three crucial Virtual Disks which included four individual Microsoft Exchange Databases.
The Resolution
The customer was relieved to receive all of their critical corporate email data back within days of initial contact with Ontrack. Overall, 12TB of data was processed at the VMFS level data in order to locate, reassemble and recover the critical 256GB of Exchange data on the NTFS level. This was a complex recovery due to all of the different layers involved. Fortunately Ontrack
is ahead of the curve and developed custom tools to work within the VSAN environment back in 2014.