Howto recover snapshots

  • Article

Hyper-V Snapshots work by using differencing disks. After you (accidentally) removed your VM from Hyper-V Manger you may realize you have important data in a snapshot.

The Snapshot file has an extension .AVHD. As you might have taken multiple snapshots the dependency might look like this.

Original.vhd->Snapshot1.avhd->Snapshot2.avhd->...->SnapshotN.avhd.

You cannot easily rebuild a VM with this Snapshot chain. You could modify a new VM Settings to point to the SnapshotN.avhd, though, and be able to start the VM.

To recover this chain, you need to merge this chain into either a new vdh or recursive up into the Original.vhd.

Below methods require to specify the avhd file. The Hyper-V Manager Option "Edit Disk" only displays this file type since R2. So you may need to rename the .avhd to .vhd to be able to select it.

 

1. Merging into a new VHD.

The preferred method if you have enough disk space. Merging a dynamic vhd, may theoretically result in a file as big as the sum of all .avhd's + Original.vhd.

- In Hyper-V Manager, use "Edit Disk", select the .avhd you want to merge. Most likely the last in the chain

- Next, Select Merge, To a new virtual hard disk, Pick a path&name, Select dynamic or fixed as needed.

- Next, Finish. This might take some time as all data files need to be copied into the new.vhd

 

2. Merging into the Original.vhd (2 possible Methods)

2.1 Merging into the Original.vhd using Diskpart

 - Start an elevated CMD Prompt. Run Diskpart

 - Within Diskpart select the last Snapshot. “select vdisk file=<path>\SnapshotN.avhd”

 (You need to know how many avhd childs the chain has to specify the Depth. You cannot specify more. If you specify less, the merge will happen to a Snapshot in between, and you need to restart from there. vdisk detail can give you the name of the direct predecessor)

 - Within Diskpart merge with. “merge vdisk depth=N”

2.2 Merging into the Original.vhd using Hyper-V Manager

 - In Hyper-V Manager, use "Edit Disk", select the .avhd you want to merge. Most likely the last in the chain

- Next, Select Merge, To the parent virtual disk. Note, the parent is actually only one level above in the chain, so might be snapshotN-1.avhd.

- Next, Note the name of the parent disk that we will merge to. If this is a .avhd, you need to later pick that one and merge it, until you merged with Original.vhd

- Finish, This will merge one avhd with its parent. It the parent is again a .avhd, you need to start over with the parent until you reach the Original.vhd

 

Note that a differencing disk (what a .avhd essentially is) contains a absolute and relative path to its parent disk. This location is used when you merge the disk with it's parent. So when you want to merge files you copied away as a backup, bear in mind that the merge may actually modify your originals.

Cheers

-Robert

Comments

  • Anonymous
    February 19, 2009
    Dear Robert, Great to see this issue being documented somewhere. I'd like to enhance this a bit to perhaps give people a bit more confidence to perform such a critical operation. For simplicity, let's assume there are 3 files, but there can be any number of snapshots, the process is the same:
  1. The original VM hard disk file (file1.vhd)
  2. The first snapshot (file2.avhd)
  3. The second snapshot (file3.avhd) Now follow this process:
  4. Rename file3.avhd to file3.vhd
  5. In Hyper-V Manager, merge file3.vhd into file2.avhd using the „Edit Disk“ function
  6. After completion, rename file2.avhd to file2.vhd
  7. Merge file2.vhd into file1.vhd
  8. Now the based VHD (file1.vhd) is updated with all changes. If there are more snapshots, just do step 1 and 2 for all preceeding snaphot files, starting with the last snapshot file created (with the earliest date). One important thing: after a successful merge, the snapshot file which has been merged will be deleted without prior notice (room for improvement here in my opinion)! So if you want to be on the safe side, back it up before! The priciple behind the snaphots is that each snapshot (child) just knows about the preceeding snapshot or base VHD (parent). You can see that easily by using the „Inspect Disk“ function. We figured this out quite painfully as we were told to start with the first instead of the last snapshot file, which will make it impossible to recover any further snapshots. Ingo

  • Anonymous
    September 14, 2010
    That's just awesome.......I have been searching all around and finally got this solution......thanks much guys !

  • Anonymous
    November 05, 2013
    Is it correct to assume that it is the same for avhdx ?