Hyper-V VHDX: virtual disks and checkpoints even from degraded cluster volumes.
Hyper-V uses the VHDX format (successor to VHD) for virtual disks, often on an NTFS Cluster Shared Volume (CSV). Recovery requires a working knowledge of the VHDX format (block allocation table, log), of CSV and of checkpoint chains.
VHDX, checkpoints, CSV.
- Corrupted VHDX: inconsistent BAT (Block Allocation Table), unflushed log, alignment problems. Recovery at VHDX structural level.
- Orphaned checkpoints: AVHDX files (checkpoint delta files) present without the correct parent VHDX. Chain reconstruction.
- Degraded NTFS CSV (Cluster Shared Volume): recovery of the underlying NTFS filesystem first, then recovery of the VHDX files.
- Deleted VMs: VHDX files still left on the volume, recoverable if not overwritten.
Non-destructive, on clones.
- Read-only snapshot of the CSV or cloning of the underlying LUNs.
- VHDX rebuilt in the lab, never on the original volume.
- Controlled merge of the AVHDX chain onto the parent VHDX, following the checkpoint order.
- Recovery of the guest filesystem inside the VHDX (NTFS, ReFS, etc.) — second level of analysis.
The questions we get most often.
Hyper-V also generates XML/JSON VM configuration files: do those need recovering?
Yes where possible, but the real payload is in the VHDX files. The VM configuration (.vmcx, .vmgs or .xml file depending on the version) can also be rebuilt by hand if you know the workload — once the VHDX is recovered, the VM can be recreated around it.
CSV failed: what impact does that have on recovery?
CSV is an additional layer (NTFS shared across multiple hosts). If the CSV has failed, recovery may require access to the underlying LUNs from the storage side (SAN) before the VHDX files can be recovered.
Can I keep using the Hyper-V cluster while you run the recovery?
No, not on the suspect volume. In a cluster, writes arrive from several hosts at once and can overwrite VHDX blocks that are critical for the recovery. Standard policy: the affected VM roles are stopped, the CSV goes into maintenance or offline, we clone it, and it returns to production only once the recovery is complete.
Dynamic or fixed VHDX: does it change the odds of recovery?
Yes. A fixed VHDX allocates every block at creation and keeps them contiguous: even with a damaged BAT, the data stays reconstructable by position. A dynamic one allocates blocks on demand, scattered through the file, so it relies on the BAT to know where they are — if the BAT is corrupted it has to be rebuilt before anything can be read. Dynamic is not unrecoverable, but it takes more work.