1. Required: root-access to an ESXi-host via ssh
2. Identify the device that corresponds to the affected datastore:
login with root account
ls -lisa | grep -v vml
In many cases you can identify the correct device by inspecting the referenced filesize – typically several hundred of GBs or several TBs.
If lots of datastores with similar size are in used – use
for a more detailed description of the available devices.
3. dd command to dump the first 1536 MB of DeviceX into a file
dd if=/dev/disks/Device:1 bs=1M count=1536 of=/tmp/Casename.1536
3a. Very often there is not enough free space available in /tmp
Workaround: dump into an archive:
dd if=/dev/disks/Device:1 bs=1M count=1536 | gzip -c /tmp/Casename.1536.gz
3b. if that still does not work use another datastore – BUT never use the affected datastore itself!!!
dd if=/dev/disks/Device:1 bs=1M count=1536 of=/vmfs/volumes/ANOTHER-UNAFFECTED-DATASTORE/Casename.1536
4. connect to ESXiHost via WinSCP
download /tmp/Casename.1536 to admin-host
5. download the tool strings.exe from https://technet.microsoft.com/en-us/sysinternals/strings.aspx
after download unzip strungs.exe and copy it to the same path that already has Casename.1536
open a cmd-box and execute
strings.exe Casename.1536 > Casename.1536.txt
Search through Casename.1536.txt
That file will contain information that is confidential and you may not be allowed to pass it to a 3rd party.
If you dont care about this – compress Casename.1536 with an effective packer like 7zip or rar.
6. you should now have an archive that varies in size – typically range is 50 MB – 800 MB
7. upload the archive to a freehostser, your webserver, or any other public location with a decent downloadrate.
(skype can be used too – but is a comparably slow option)
When upload is done – provide a downloadlink – typically this also is the perfect time for a short slype-chat
8. in most cases it takes one or two hours to get a solid overview of the prognosis and available recovery options.
There is a Knowledgebase-article that discuss the same topic – see https://kb.vmware.com/kb/1020645