Deleted VMware disk response
Deleting a virtual disk can remove a small descriptor, a large extent, or an entire snapshot chain. The guest data may remain in unallocated datastore space until new virtual machines, snapshots, logs, thin growth, or maintenance reuse those blocks.
Understand the symptom
Recovery depends on datastore version, thin or thick provisioning, file type, snapshots, storage-array behavior, TRIM or UNMAP, and subsequent writes. A descriptor can sometimes be reconstructed when its extent survives, but a deleted extent requires storage-level preservation and metadata analysis.
What you may see
The VMX still references a VMDK that no longer appears in the datastore browser.
The small text file is present while its flat, delta, or sparse extent is missing.
A descriptor was removed, leaving a large data file without its geometry and provisioning context.
Deletion may have removed one parent or child while other layers remain.
Protect the source
Logs, snapshots, swaps, clones, and thin growth can overwrite deleted extents.
Incorrect adapter, extent name, sector count, or provisioning assumptions can damage the interpretation.
Released blocks can be discarded below VMFS depending on storage behavior.
Do this now
Power off or migrate unaffected workloads only when that can be done without writing to the affected volume.
Take an array snapshot or image the datastore before rescan, resignature, or repair.
Save listings, sizes, timestamps, VMX, VMSD, descriptors, extents, locks, and host logs.
Note who or what deleted the disk, later tasks, backups, snapshots, and priority guest files.
NEPFOSYS process
NEPFOSYS distinguishes missing descriptors from deleted extents and incomplete snapshot chains.
VMFS metadata and surviving data ranges are evaluated on protected storage copies.
Candidate virtual disks are validated through partitions, file systems, databases, and requested files.
A clear next step
Start a case with the exact symptoms, incident timeline, prior attempts, encryption details, and the files that matter most. NEPFOSYS will route the case to the appropriate DFW intake or nationwide mail-in path.
Start with a case reviewQuestions, answered
Only when the correct extent survives and its exact geometry and chain role can be established.
No. Browsing shows allocated files, not necessarily recoverable deleted extents.
Minimize datastore writes. The safe shutdown or isolation choice depends on where logs, swaps, and other workloads reside.
DFW local · Nationwide mail-in