Complex VSAN Data Recovered

Written By: Ontrack

Date Published: August 14, 2022

Complex VSAN Data Recovered

The Situation

The VSAN system consisted of three nodes, each with one solid state drive (SSD) and seven hard drives (HDD). The initial drive failure was an SSD on the one of the nodes. The second drive failure was an SSD on a separate node. The 24 drives appear in the VSAN as individual VMFS data stores.  Each Virtual Machine (and snapshot) in this case was comprised of a file level RAID made up of six individual files.

 

The Solution

The system integrator sent all 24 drives to the  Ontrack lab in Singapore via priority shipping.  Once received, the drives were imaged and the  Ontrack engineers began reassembling the  data. The affected Virtual Machine was found to  contain three individual virtual disks with between  one and four active snapshots each. The virtual disk  and snapshot VMDKs were found to be comprised  of a mix of file level RAID1s and RAID10s in the  VSAN system. Several of the RAID10 VMDKs were  found to be degraded. Using proprietary recovery  tools, engineers at Ontrack were able to map  the VSAN files and rebuild the file level RAIDs,  excluding degraded files where appropriate. Once  the snapshots were merged, Ontrack was  able to recover all of the data for the three crucial  Virtual Disks which included four individual Microsoft  Exchange Databases.

The Resolution

The customer was relieved to receive all of their  critical corporate email data back within days  of initial contact with Ontrack. Overall, 12TB  of data was processed at the VMFS level data  in order to locate, reassemble and recover the  critical 256GB of Exchange data on the NTFS  level. This was a complex recovery due to all of the  different layers involved. Fortunately Ontrack

is ahead of the curve and developed custom tools  to work within the VSAN environment back in 2014.

Subscribe

KLDiscovery Ontrack, LLC, 9023 Columbine Road Eden Prairie, MN 55347, United States (see all locations)