[SOLVED] VMware ESXI 5.0 server rack - data retrieval

[Anthony Gnesotto]

A gentleman who sold his business asked if I could get a database file off his server. He brought the server rack into me and I hooked it up with no knowledge of what he had running before (He sold his business and wanted the customer database file off the server so he could pass it on to the new owner, he didn't want to give him the whole server because of other information that may be on it.)

That being said... I booted up the server and landed myself into a VMware ESXI 5.0 screen that I've included a picture of.

I have experience with servers, however, I've not dealt with VM clients or ESXI at all. I did some research but more or less confused myself more than I helped myself. The client, of course, has no knowledge of anything involving the server and how it was set up so I really don't have much to go off

Inside there are 3 hard drives. 1 is a 500GB seagate and the other 2 are 3000GB seagates. By the looks of things it boots from the 500 and I had assumed the 3000's were setup in a raid but that may be inaccurate. After pulling the drives the only one I was able to pull up on my docking station was the 500GB drive. (I also tried a USB to SATA cable and same results)

The 500GB drive didn't appear to have the "Ship Works" folder or information on it and it had 4 different partitions, most of which included things like VM, boot, etc type information. It didn't appear to contain any other information.

SO my question is, how can I access the information on the other 2 drives (is it maybe the format they're in can't be read in windows?) OR is the a way I can actually login to and use the server (as if it were a windows server) so I can gain access and find this Ship Works database file?


Thank you in advance, I greatly appreciate your time and effort in helping me resolve this issue.

 

[Markverhyden]

If your customer is willing to spend money on this then stop what you are doing and get in touch with a qualified DR specialist. Especially if the 3tb drives have problems, you are making things worse every time you bring up the machine. Even if they are OK you could ruin things by trying to fiddle around with the arrays/partitions.

If this is a fishing expedition, then feel free to learn. What you need to do.

1. make a LAN which has a IP scope of 10.1.10.x.
2. using a Windows OS machine on the same LAN connect the browser to 10.1.10.253.
3. if the vm is working ok you will have an option to download and install the connector.
4. once installed you launch the connector, put in the IP address of 10.1.10.253 and the username and password. The username and password is the same as the one you use to log into the local console. If you cannot log into the local console then you are probably SOL as there is no reliable way to reset the password of the ESXi host.
5. if you can log in you will see which machines are present and be able to spin them up as well as launch a local console on the target machine(s)

 

[Nerm]

Go to the IP listed on the screen (10.1.10.253) and install the vsphere client software. You manage the host, VM's, etc from that.

 

[DataMedics]

If you know the password then you just need to use the Vsphere client software as Nerm pointed out and you can then access the virtual machines that the server runs, one of which contains the database. Or if you don't then any decent pro data recovery service provider should be able to figure out the possible RAID settings, extract the VMDK files (virtual disk images), and extract the actual database files from there.

Let me know if you'd like a quote for us to do the work (www.data-medics.com). I know another member of this forum Luke (www.recoveryforce.com) should also be able to handle it. We can probably even do it remotely if you're willing to make a small investment in some software.

 

[Anthony Gnesotto]

Thank you Mark, the information you provided is what I was hoping to hear! I've begun the process, so we'll see how things turn out. Thank you Nerm as well.

Also, DataMedics, I will surely contact you if I can't get this figured out. The client needs the information by next wednesday, 1-27-16, but I'm fairly confident I should be able to get it from here.

Thank you all again, I will post an update with my results later this afternoon.

 

[DataMedics]

Just keep in mind that the drive(s) don't have a Windows filesystem on them. They aren't formatted to NTFS, FAT32, HFS+, or any of the other filesystems that even most data recovery software supports. The filesystem is VMFS where the actual VMDK files are stored.

 

[Anthony Gnesotto]

OK, so I've gained access to the machine. I can see the files I need, but I'm having trouble figuring out how to copy the files I need to the machine I'm accessing them from. I'm accessing them through the VM client, but can't find anything to allow me to copy and paste the files to my machine. What would be the easiest way to do this?

 

[Markverhyden]

Well, if you can log into the client app and view the VM's that's half the battle. Hopefully the machine was gracefully shutdown and the VM's are either set to auto start or you should be able to spin them up. And you can attach a USB HD to the VM. But, as @DataMedics said, these drives are not conventional file systems.

https://pubs.vmware.com/vsphere-50/...UID-3E6E58AA-2AD4-4370-9955-07E5FBDE800D.html

 

[Pixelated Tech]

In reference to @markverhyden post, here is a video to help assist. I run quite a few ESX boxes myself.

 

[Anthony Gnesotto]

Scratch that last comment guys, I GOT IT!

I just added a USB device to the machine and it showed up so I just transferred it to that, really was a piece of cake, just not a kind I had eaten before

I can't thank you guys enough for your help and info!

If there is one thing I'd like to learn more about, its whatever the hell I just dealt with lol.
BTW @Pixelated Tech , that video was on point, that was exactly what I did. Thank you!

Thanks again guys!

 

[Pixelated Tech]

Always happy to assist.

 

[Markverhyden]

If there is one thing I'd like to learn more about, its whatever the hell I just dealt with lol.

Personally, I can't recommend enough that all techs supporting businesses should learn about VM's. Just like other past changes in our industry segment, like smart devices, this is here to stay.

You don't have to spend big bucks to learn. Getting a real server on eBay that can handle VM's are relatively low cost. If that is too much just bump up the RAM on a good desktop and use a dedicated 1tb+ drive. ESXi is free and runs on most hardware. Even if you do not have something like M$ Action Pack you can download fully function Server and Desktop M$ OS's via Technet. FYI, an Action Pack subscription includes a credit for Azure which is M$'s Cloud virtualization technology. Most Linux distro's also have virtualization but I have not tested any of them. M$ Server OS's also have their own local machine VM technology but I've not tested those either.

Signing up for a free Amazon Web Services account is another option. With EC2 you get free time for 12 months for basic services, including some M$ server instances.

There is nothing worse than being onsite dealing with some cloud, which are almost all VM's, issue and one ends up looking like a deer in headlights when trying to explain/figure out what is going on. Besides you might end up using VM's in your own business. I have my email server running on one FC 22 instance and will be moving my ownCloud from my MacMini to another FC22 instance. Local VM's also make it easy to let one load and test pre-RTM OS's for testing.

 

[ChrisTech]

+1 on what Mark said.

I'm in no way a VM expert, but having VMs available to me has helped in many ways, the most recent is using a VM to test some security software fully, before offering it to my customers. The list goes on but having a clone-able instance of an OS can be very handy.

Plus you can run/test various operating systems including OSX (cough). Allegedly.

 

[Markverhyden]

Plus you can run/test various operating systems including OSX (cough). Allegedly.

Really? Gasp!!! You mean someone would ignore Apple's EULA? LOL!!!!!

 

[Pixelated Tech]

Really? Gasp!!! You mean someone would ignore Apple's EULA? LOL!!!!!

Because none of us have ever done this before...

 

[ChrisTech]

Really? Gasp!!! You mean someone would ignore Apple's EULA? LOL!!!!!

Because none of us have ever done this before...

As if we would do something like that!

 

[Markverhyden]

As if we would do something like that!

Of course no responsible tech would! Just look at how hard Apple bends it's customer's over backwards bends over backwards for it's customers. Just like M$. Never thinking of themselves first.....

 

[DataMedics]

Actually, technically speaking if you buy a copy of the OS they can't legally prohibit you from installing it on non Apple hardware. You just have to modify the installer to ignore the hardware ID, and it's perfectly legal. I ran a MacOS VM for years for that occasional time I needed to do something in Mac OS. Now I just keep a Mac Mini on the shelf for when that need comes up.

 

[Markverhyden]

Actually, technically speaking if you buy a copy of the OS they can't legally prohibit you from installing it on non Apple hardware. You just have to modify the installer to ignore the hardware ID, and it's perfectly legal. I ran a MacOS VM for years for that occasional time I needed to do something in Mac OS. Now I just keep a Mac Mini on the shelf for when that need comes up.

Sorry, but that is completely wrong. To begin with you are not "buying" in the sense that you own the software. It's more like a rental fee. And by using the software you are explicitly agreeing to the EULA, which includes when, where, how, etc it is installed and used. That applies Apple and M$ OS's as well as pretty much all major applications.

Just because you can do something does not mean you are adhering to the EULA.

 

[DataMedics]

Yes, and no. While their EULA can say whatever it wants, it won't hold up legally. This is a case that's been heard over and over in court and every time it's been decided that you can't force a software purchaser to run it only on specific hardware if that software is sold independently of the hardware. Printer manufacturers like HP also put an EULA which says you can only buy their ink or you void the warranty, but it's lost every time it's gone to court.

The real catch is you have to do it yourself. To sell a machine with it already installed is actually illegal and you will lose that battle if you get sued. However even Apple's own EULA allows for installing the software on a VM so long as you have the license for the software. They try to specify that it still must be run on Apple hardware, but as we all know VM's are portable and if you just happen to "back up" the file to a Windows or ESXi machine you're fully within your legal rights.