How do I Fix a Corrupted Virtual Hard Disk?

People occasionally contact me and ask me how to fix a virtual hard disk that they have which is reporting corruption. 

The short answer is: "Run data recovery tools inside the virtual machine."

For the long answer we need to look at how the virtual hard disk is structured.  Reading from the Virtual Hard Disk specification (available here) you can see that virtual hard disks have the following structure:

Breaking down the components of the virtual hard disk - there is:

• The hard drive footer:

  • The hard drive footer contains a bunch of information - like the size of the disk, the disk geometry, the disk creator, etc...  Fixed size virtual hard disks only have one copy of the hard drive footer - but dynamic and differencing disks make a second copy of the hard drive footer at the top of the virtual hard disk.

• The dynamic virtual hard disk header:

  • The dynamic virtual hard disk header contains information about where the block allocation table is, as well as some of the parameters of the block allocation table structure.  It also contains the information for differencing disks to point to appropriate data locations on the parent virtual hard disk.

• The block allocation table:

  • The block allocation table is used by dynamic and differencing virtual hard disk in order to map requests for virtual hard disk offsets to the actual location on the physical hard disk (this is not needed in fixed size virtual hard disks as they have a constant offset value).  Depending on the size of the virtual hard disk the block allocation table can range in size from a couple of KB to a couple of MB (8MB is the largest block allocation table I have seen).

• Data blocks:

  • This is the bulk of the virtual hard disk and is the raw data that the virtual machine has written to the virtual hard disk.

Now let us look at the implications of data corruption in each of these areas - and the possible actions you can take:

• The hard drive footer:

  • Stored in the hard drive footer is a CRC checksum.  If this footer is corrupted we will detect it immediately.  In the case of a dynamic or differencing virtual hard disk we will attempt to restore the footer using the mirror copy at the top of the file.  In the case of a fixed size virtual hard disk (or for a dynamic or differencing virtual hard disk where both the footer and mirror have been corrupted) you will be presented with an error saying that the virtual hard disk is corrupted when you try to start the virtual machine (or edit the virtual hard disk).

    There are no tools or methods available for fixing this sort of corruption - and your only option is to restore a copy of the virtual hard disk from your most recent backup (you are backing up - right?).  Keep in mind that the footer is only 511 bytes in size - so the chances of if getting corrupted are relatively low.

• The dynamic virtual hard disk header:

  • The dynamic virtual hard disk header uses a CRC checksum similar to the hard drive footer.  As there is no mirror - corruption of this section of the virtual hard disk will also result in an error message from Virtual PC / Virtual Server / Hyper-V that states that the virtual hard disk is corrupted.  There is no way to recover from this sort of corruption (apart from restoring a backup) - but like the hard drive footer, the chances of corruption here are low due to the fact that it is only 1KB in size.

• The block allocation table:

  • There is no checksum on the block allocation table.  As such, if this section of the virtual hard disk were to be corrupted - you would start seeing file system errors inside the virtual machine as it would be directed to the wrong section of the virtual hard disk to read data.  There is no way to correct this sort of corruption.

• Data blocks:

  • The data blocks are completely opaque to Virtual PC / Virtual Server / Hyper-V.  Which is to say that the guest operating system writes data to the disk, and we just pass it on.  We do not know what file system is being used or what sort of structures exist here.  As such Virtual PC / Virtual Server / Hyper-V will never detect or report corruption that happens inside the data blocks.  Rather this sort of corruption will be reported by the guest operating system (either through error messages and warnings in the guest operating system - or in extreme cases - through failure to boot).  The way to handle corruption here is to treat the virtual hard disk just like a corrupted physical hard disk - and to boot the virtual machine and run data / disk recovery tools inside the virtual machine.

With all of this information I can provide the "medium length answer" as to what to do with corrupted virtual hard disks, as follows:

• If Virtual PC / Virtual Server / Hyper-V report that the virtual hard disk is corrupt - then one of the header / footer sections has been corrupted - and there is nothing that you can do.
• If the virtual machine starts correctly - but then reports errors accessing the disk - run data recovery tools inside the virtual machine.
• Always take backups of important virtual machines.

One final point I would like to make here is this - if you ever suffer data corruption in a virtual hard disk it is important that you figure out how it happened.  The two most common causes I have encountered are:

• Data corruption due to faulty / failing physical storage
• Data corruption due to transferring files over faulty / failing networks

In either case you want to identify as fix the root cause as soon as possible - otherwise you are going to suffer further corruption and data loss in the future.  I strongly recommend starting by looking at the event log in the host / parent environments - as 90% of the time this will provide you with the information that you need.

Cheers,
Ben