HPE Storage Tech Insiders
Showing results for 
Search instead for 
Did you mean: 

Easy Single File Restore from a VM


Pssssst,  do you want a know a secret ?  It's a ridiculously simple way to do perform a single file restore from an active virtual machine.  It uses no tapes, hardly any storage space and most importantly it will take literally all of 5 minutes ??  Interested ? Well read on....

Before I get to the 'secret sauce'  I have to say 'I love snapshots'. They are a paradigm shift and game changer when it comes to backup and more importantly restore.  They also form a cornerstone of this pretty cool technique (my opinion) that I will show you.  Of course not all snapshots are born equally. Pretty much every array and many software platforms offer some form of snapshot implementation but how we vendors implement and to what effectiveness differs wildly.  I'm not going to dive into the Nimble's snapshot implementation details in this blog, if you want to understand whats happening underneath the covers in more detail then I would heartily recommend a quick read of the following blog - O'Snapshot What Art Thou ? Needless to say, Nimble snapshots are a great example of the most effective type of snapshots: Redirect-On-Write Snapshots and provide our customers with some compelling benefits:

  • No performance degradation (whether you have 1 snapshot of a volume or 1,000 snapshots of that same volume).
  • You can take them a frequently as you like (within reason);  Why backup once a day when I can backup multiple times per hour ?
  • They take up very little space (Compressed Incremental Block Changes is the only data that is stored).
  • They are always online and full backups.
  • They can readily cloned for a variety of purposes (Restores, QA, Development/Testing, Post-Mortem/Root cause analysis).
  • Restores are simple and super fast - allowing for decreased recovery times and increased application availability.
  • Thanks to CASL, they are stored inherently on the most cost-effective on-line medium (High capacity, Low RPM disk drives) and not associated to costly high performance storage.

The most important point of all the above is Restores;  I used to work with a colleague who's mantra was 'Backup flatters, Restore matters'.  As the Nimble removes the often found limitations of many snapshot implementations (namely, performance degradation, space utilisation, fragmented filesystem), it allows our customers to backup more frequently and therefore hold the point in time backups online for longer, allowing for much more effective restores.  Compare the following application with a traditional backup architecture and effective snapshot and the restore options available at the point of time of a disaster:


A database fails mid afternoon, I go back to my previous nights backup/dump, copy the data back and then replay forward to the point of corruption.  A huge amount of effort and time to get application back in service.  Alternatively if I am backing up using snapshots then I have a much closer restore to choose from:


It takes no time to restore the data (as there is no data movement, just a manipulation of metadata) and I am much closer to point of disaster.   It's a very different way to look at at conventional backup and restore.

Enough of this...Let's cut to chase...The Secret Sauce... the following is a demo I created that utilises snapshots to do a single file restore from a virtual machine.  It has three integral components:   Nimble Snapshots, Nimble Cloning and a piece of third party software called UFS Explorer.  Both Snapshot and Cloning are features ship with every Nimble array so no license is required to use this functionality.

Firstly I have a VMFS datastore hosted on a Nimble Storage array which is supporting a number of Guests... The datastore is esx-ds1


and that is hosted on my Nimble volume (esx-ds1):


The screenshot above shows the primary volume, it's size, it's I/O and note on the left handside this volume currently has 46 snapshots;

In order for this demonstration I am going to delete a file from my vCenter server and then individually restore that file using a snapshot backup and clone.

Note: There is no prerequisite to use vCenter it just happens to be the host that I am deleting the file and where I have installed the UFS Explorer application.

So now I am going to delete a file (SDelete.zip) to give us something to selectively restore...


If we now navigate to Snapshots tab of the esx-ds1 volume, we see a list of all the snapshots, including the time they were taken and the amount of space they currently consume.  This particular volume is being backed up once every 2 hours and once a day with the daily snapshots being held for 30 days.   I select the snapshot I wish to restore from (in this case a snapshot for a couple of days ago).  At this point I could choose to unmount the datastore and restore the entire volume (which would restore, almost instantaneously, the volume to the point of time of the backup), however that doesn't make sense as all the VM's and Filesystems located on that datastore would be restored to that point of time and I only wish to restore the single file I deleted earlier. Instead I am going to create a Nimble clone from that snapshot.  Again this is an instantaneous option as it's just a copy of metadata and will consume zero space.  As a user the only thing I have to do if give the volume a unique name (RF-SingleFileRestore in this case) and click OK.


Once completed I have a new cloned volume that consumes no space, that s based on my chosen backup that I selected from the snapshot list...


Note the space consumption and the parent/snapshot volume in the top right hand corner.  As this clone is based of esx-ds1 the Nimble GUI has automatically given it access to my esx cluster (as that is where the parent was mounted to);  So I am going to remap this clone to the host where I am going to run the restore from (my vCenter server for this demonstration).  In order to do this I edit the volume and change the access control list to remove the ESX cluster and add my vCenter host.


Now if I check the vCenter host software iSCSI initiator, I should be able to connect to the clone and see it from the Operating System....


and then see the volume is Disk Manager (Disk 1).  Note: I don't want to format this volume and put NTFS on there as it's a VMFS volume and my backup data is already there.  Just leave it as a Physical device.


So the above there has been a few steps to get us to this point, but I wanted the reader to be aware of the steps and what is going on with the snapshots and clones.  The beauty is all the steps up to this point can be completely automated with a simple script to select a volume, snapshot, clone and mount.

So final step is to utilise UFS Explorer to pull back the file... On starting UFS Explorer Professional Recovery, you will see all the drives that the host can see - it's C-Drive, VMDK and most importantly the clone that I mapped to my guest in the previous step....


Selecting the clone and right clicking it will allow you to open and browse the VMFS filesystem....


In the right hand pane, I will now see all my guests hosted on the datastore and I can drill into each one.  Now I select the guest that I want to do my individual file restore from (my vCenter server in this example), clicking on vcenter will show me the guests VMWare files (vmdk's vmx files that are associated to the guest).  Next I navigate to the guests vmdk and again right click the file and select Open file as a disk image.  This will now open a new drive in my left hand pane which is that VMDK (vcenter-flat.vmdk):


Now I can select that drive (Open the file system)


and navigate it finding the file I wish to restore (remember this is the guest's filesystem when the snapshot was taken).  Apparently there is a function in UFS Explorer to scan and index the contents of the volume but I will save that for a future blog.


Once the file I wish to restore is located, you can right click it and 'Save this Object' back to the guest local filesystem...


Choosing the location where the object needs to be restored too...


and that's it - the file is back....


In order to clean up;  Close the UFS Explorer application and Offline and delete the Clone Volume from the Nimble GUI.

If you'd like to see this in action (in real-time), I have posted a video of the demonstration here.

Hopefully I will follow this blog up shortly with a single file restore for Exchange.

About the Author



In case you are wondering, UFS Explorer only seems to support VFMS filesystem for browsing virtual disks, apparently Hyper-V Virtual Disk support is coming in the future.

XenServer would bring us a full-house! OK add KVM and we're getting closer :-)


Thanks Phil - it also supports NTFS and many flavours of Unix Filesystems; So you can recover individual files even if they aren't virtualised.   I may post a demo of NTFS native shortly;  Also these can be achieved with the standard version of the UFS Explorer;  (VMFS requires professional).  Anyone wishing to give it it a try there is a free evaluation download available - the limitation is the size of the object that you are allowed to restore.

Hyper-V support would be pretty awesome.


Get that man an adult beverage! Thanks for going through that Rich, that's really handy to know!


You don't need a third party software for Hyper-V. Once you get the VHD/VHDX files from clone, you can attach them to any Win7/Win8/Win2008/Win2012 computers to see the files in them.

This is how I restore files too and I agree it's very easy. We looked at the CommVault Simpana snapshot management solution but for the amount of restore we do every year, it's really not worth the money to buy CommVault.


Thanks Jason Liu for that tip - I'll be sure to give that a try


Having tried this, it does appear that the VHDX format (Hyper-V v3) can only be opened by Windows 2012 (tested) or Windows 8 (not tested). This is really easy as Jason suggested, in Windows 1012 you just have to double click the VHDX file and it is mounted like a new drive or right-click on the file and select "Mount".

I couldn't find a way to open a VHDX file using Windows 7 - Windows 7 only sems to understand the older VHD file type and it doesn't look like MS have given support for VHDX mounting on Windows 7 - are they telling us they want us to upgrade to Windows 8 perhaps? If anyone is aware of a tool that will allow this, please post here!


Is there a cheaper/free alternative to UFS Explorer? I can't trial it thoroughly enough to recommend it unfortunately as it limits the recovered file size to less than a MB. Shame.


Hi Greg

Yea unfortunately the UFS explorer eval license is limited to 5mb files. Perhaps some of the readers of this thread can share their experience with you (I know from experience it has been a very popular utility)

Fundamentally I see no issue with larger files as the principals are exactly the same




Hi Rich, thanks for your reply, and the guide too. It would have been nice to have tried out UFSE for a couple of weeks first, in the real world rather than just test files. We're a business, so technically I should be buying the £700 license too. That's a lot of money unless it works as a complete archive and backup solution for our Nimble file storage. I'll have a look around and see if we can find something else.

Thanks anyway.


Hi Greg, 

I would view UFS Explorer as a utility or tool for facilitate simple file restores.  It certainily isn't a full fledged backup/archive solution as there are many items that would be missing (Reporting, Cataloging/Indexing, Off-site copies to alternative media).  

If you are looking for something that is integrated to Nimble snapshots that has this  capability then I would look towards products like Commvault, Symnatec Netbackup/BackupExec which can all work with snapshots.   Of course there are also several other data protection software like Veeam which also offer similar capabilities to restore data from snapshots (Veeam Explorer range) 

Hope this helps 



I just tried this and it works great.  For my 3 large file servers in VMware (1TB or greater each) this is all I will need for the half a dozen file restores we do each year.  I can turn off Backup Exec for these file servers and go with 1 second backup windows now (snap shot) and probably use way less space in the long run.



Nice post

But if you are using VMware then there is no need to use UFSE tool.

Use the vCenter plugin to clone a snapshot as a datastore. (This takes seconds and does all of the tasks for you)

Find a suitable VM, apart from the one you are restoring. (The OS wont like adding duplicate disks)

Edit the VM - add an (Existing Hard Disk) browse to the restored Datastore and add the desired VMKD.

Login to the VM you have added the disk too and hay presto you can browse the drives of the restored VMKD's.

Take the disks offline when you are done, remove the hard disk from the VM and delete the datastore using the vCenter plugin.


Thanks for commenting on the thread Sean - yes, that is a perfectly good alternative route. I will also create a similar blog shortly on how this could be accomplished with the Veeam Explorer tools (using v9.5)  that could also automate some of the more manual steps (like cloning and presenting the LUN's to the server.

See posts for
HPE at 2018 Technology Events
Learn about the technology events where Hewlett Packard Enterprise will have a presence in 2018.
Read more
See posts for dates/locations
Reimagine 2018
Join us at one of the Reimagine 2018 stops and see how we Simplify Hybrid IT, innovate at the Intelligent Edge and bring it all together with HPE Poin...
Read more
View all