Recover Data on VHD and VHDx

Dedicated department that can run 24 hours exclusively for data recovery on VHD and VHDx systems.

Recovery virtual machine




25 years








Recover Data from VHD and VHDx

We can recover data on virtual machines lost for any reason

After the creation of virtual machines a world of new possibilities came into existence. The cornerstones of this innovation are the systems that manage the virtual machines and the files that contain the virtual machine data.

The biggest players on the market today are VMware, Hyper-V, Xen Server and Virtual Box. The files we will talk about in this text (VHD and VHDx) are the files created and managed by Microsoft’s Hyper-v.

VHD and VHDx files are virtual machine (Hyper-v) files created by Microsoft. These files have a complex structure for storing and reading data that in many cases can exceed the speed of a hard disk.

In other words, a VHD or VHDx file stored on a hard disk not only provides IT managers with a lot of flexibility, but it can also work better and faster than if the data were written to the disk where it is stored.

There are numerous advantages to using a virtual machine instead of a physical hard drive. These include the creation of virtual disks with dynamic space allocation. This means that we can have a virtual machine with dozens of Terabytes but occupying disk space equivalent to the information contained in the machine.

In practice this means that a VHDx with a 10Tb partition that only has 1Tb of data allocated will only take up 1Tb of disk space.

This provides an unprecedented optimization and space saving, allowing storage rooms and other data storage systems to be fully used, because no machine or server will allocate more space than is really necessary for its activities.

These files (virtual machines) can be anything from a simple workstation to high-performance servers. The architecture of these files (VHD and VHDx) are very well designed and you rarely hear any complaints about them.

But like any other type of file, external factors can result in data loss and other problems that directly impact the user’s sensitive information.

These files (virtual machines) can be anything from a simple workstation to high-performance servers. The architecture of these files (VHD and VHDx) are very well designed and you rarely hear any complaints about them.

But like any other type of file, external factors can result in data loss and other problems that directly impact the user’s sensitive information.

Why Digital Recovery?

Digital Recovery is a company specialized in all types of data loss. RAID systems, NAS and SAN storage, Oracle, MS SQL, My SQL and Firebird databases are our specialty. In case you have received the sad news of a negative diagnosis, we have total interest in analyzing your case.

We have developed software and hardware technologies that enable us to act with precision and agility in the data evaluation and recovery processes. The creation of these technologies has made Digital Recovery unique on several service fronts.

One of our technologies called Tracer is capable of automating numerous processes by analyzing millions of pieces of information, reducing the time to perform services from several weeks to a few hours.

We are a 100% Brazilian company with a branch in Hamburg, Germany. Other partnerships for information exchange and technology sharing are made between companies in countries such as the United States, Russia, and Ukraine.

If your data storage devices are somewhere in the world where we do not yet have a laboratory, we have the technology to assess and recover your database remotely. If this is the case for you, please consult us.

If you need it, we can also provide you with a Non-Disclosure Agreement (NDA) in a language of your choice. Talk to one of our experts.

Calm down, your data can be retrieved

Digital Recovery

We will run an
advanced diagnosis

Get the quote for your project

We kick off the data reconstruction

Get your data back

We are always online

Please fill out the form, or select your preferred contact method. We will contact you to start recovering your files.

Customer experiences

Success Cases

What our customers say about us

Companies that trust our solutions

Answers from our experts

What causes data loss in VHD and VHDX virtual machines?

The most common problems involving data loss in VHD and VHDx file types are:


Because the Windows Recycle Bin has a limited space for deleted files (around 5% of available disk space), when a large file is deleted it is usually not stored in the Recycle Bin. Therefore, it will not be possible to go to the Recycle Bin to try to recover the file, because it will not be there.

The solution to this problem can be solved by finding the MFT (Master File Table) of the deleted file and recovering it. There is some software on the market that can do this. But in some cases the MFT is also deleted. When this happens it will inevitably require the intervention of a professional data recovery specialist.

In some cases data recovery software can even find a file with the same name or size as the file the user wants to recover, but most of the time this file has serious corruption problems. It is likely that the file is fragmented (sometimes with thousands of fragments) and not being able to access the partition metadata it may not be possible to reconstruct it by data recovery software.


Partitions are like giant mathematical equations with thousands of variables that are managed by the software that is the operating system. This giant mathematical equation allows users the fantastic experience of storing and removing information in the digital age.

Partition systems can run perfectly like clockwork for years without any problems happening. But hardware failures, electrical problems, or even human error can cause one of the cogs in this fantastic clock to break, causing unpredictable problems that the operating system will not know how to fix.

In cases of partition system corruption the operating system will try to repair the problem. To do this it triggers a process to check the disk and the partition.

In most cases the problem is solved, but in some more severe cases the system may not be able to catalog all the necessary information from one or another file and simply write zero bytes to a file that previously contained thousands of extremely important pieces of information. In our view, writing zero to the size of a file that contained important information is a very serious failure of the operating system.

In an attempt to solve the problem the operating system ends up making an already serious problem even worse. In this case it is unlikely that any data recovery software will be able to reverse the problem.


Ransomware attacks have become so common that it is practically impossible for an IT technician not to know the story of some company or professional who has already suffered from this.

The attack consists of breaking into computers, encrypting the data, and then demanding a ransom. In other words, hackers break into your computer, encrypt your information with a gigantic password, and then contact you for money to release the password to unlock your data.

When this happens there is not much you can do except resort to backups, which unfortunately are often encrypted by hackers as well. The other alternative is to pay the hackers to get the encryption password. Besides the decryption process not being something simple even when you get the password, it is very difficult to believe that when you make the payment the hacker will not ask for more money. Unfortunately we know several stories like this.

If by any chance you have been attacked by ransomware and need help, please consult one of our experts. We have developed several studies in this area and have already managed to recover numerous cases of virtual machines (VHD, VHDx and VMDk) attacked by ransomware.

Can a snapshot replace a backup?

No way, the snapshot is not a backup! We have attended many cases where the customer believed this, so it is valid to make clear what the snapshot actually is.

The snapshot is a kind of freezing of the parent virtual machine and the creation of a new virtual machine, which will be attached to the parent, but without using it. The new data is written without consuming the space and performance of the parent virtual machine.

In these terms the snapshot may look like a backup, but in no scenario can it be used as such. It is recommended that a backup of the data is always available.

Are there any recommendations for the use of Snapshots?

Yes, there are some best practices that need to be taken into account, they are:

  • Use the Snapshot for a maximum of 72 hours, after that it is recommended that the data be consolidated on the parent virtual machine.
  • The Snapshot should not be too big, its size influences the time of the data consolidation process.
  • Do not have more than three Snapshots.

Latest insights from our experts

What you need to know

We have a thorough knowledge of all the major virtual machines on the market, and our unique technologies enable us to recover data regardless of the reason for the data loss.

Our technologies allow us to recover data from the following virtual machines:

  • Microsoft Hyper-V
  • Oracle VirtualBox
  • VMware
  • Citrix
  • Acropolis
  • Microsoft Virtual PC
  • QEMU

It is not possible to establish a price without first diagnosing the affected virtual machine, we can make a thorough diagnosis in the first 24 hours, after which we provide a quote.

It is worth remembering that payment is only made after the recovery process has been completed and after the recovered files have been verified by the customer himself.