Recover Data on VHD and VHDx

Dedicated department that can operate 24 hours exclusively for data recovery on VHD and VHDx systems.

Recovery virtual machine




25 years








Recover Data in VHD and VHDx

We can recover data on virtual machines lost for any reason

Since the creation of virtual machines, a world of new possibilities has come into existence. The cornerstones of this innovation are the systems that manage virtual machines and the files that contain the data of the virtual machines.

The biggest players on the market today are VMware, Hyper-V, Xen Server and Virtual Box. The files that we will talk about in this text (VHD and VHDx) are the files created and managed by Microsoft’s Hyper-v.

The VHD and VHDx files are virtual machine files (Hyper-v) created by Microsoft. These files have a complex structure for storing and reading data that in many cases can surpass the speed of a hard disk.

In other words, a VHD or VHDx file stored in a hard disk, besides providing a lot of flexibility to IT managers, can still work better and faster than if the data were saved in the disk where they are stored.

There are numerous advantages in using a virtual machine instead of a physical HD. These include the creation of virtual disks with dynamic space allocation. This means that we can have a virtual machine with tens of Terabytes but occupying the disk space equivalent to the information contained in the machine.

In practice this means that a VHDx with a 10Tb partition that has only 1Tb of allocated data, will occupy only 1Tb on disk.

This provides an unprecedented optimization and space saving, making storage and other data storage systems to be fully used, because no machine or server will allocate more space than is really necessary for their activities.

These files (virtual machines) can be from a simple workstation to high performance servers. The architecture of these files (VHD and VHDx) are very well elaborated and we rarely hear any complaints about them.

However as any other type of file, external factors can result in data loss and other problems that will directly impact the user’s sensitive information.

These files (virtual machines) can be anything from a simple workstation to high performance servers. The architecture of these files (VHD and VHDx) are very well designed and you rarely hear any complaints about them.

However, like any other type of file, external factors can result in data loss and other problems that will directly impact the user’s sensitive information.

Why Digital Recovery?

Digital Recovery is a company specializing in all types of data loss. RAID systems, NAS and SAN storage, Oracle, MS SQL, My SQL and Firebird databases are our speciality. In case you have received the sad news of a negative diagnosis, we have total interest in analysing your case.

We have developed software and hardware technologies that enable us to act with precision and agility in the processes of evaluation and data recovery. The creation of these technologies has made Digital Recovery unique on several service fronts.

One of our technologies called Tracer is capable of automating numerous processes by analyzing millions of pieces of information, reducing the time to perform services from several weeks to a few hours.

We are a 100% Brazilian company with a branch in Hamburg, Germany. Other partnerships for information exchange and technology sharing are made between companies in countries such as the United States, Russia and Ukraine.

If your data storage devices are somewhere in the world where we do not yet have a laboratory, we have technology to assess and recover your database remotely. If this is the case for you, please consult us.

If you need it, we can also provide you with a Non-Disclosure Agreement (NDA) in a language of your choice. Talk to one of our experts.

Calm down, your data can be retrieved

Digital Recovery

We will run an
advanced diagnosis

Get the quote for your project

We kick off the data reconstruction

Get your data back

We are
always online

Please fill out the form, or select your preferred contact method. We will contact you to start recovering your files.

Customer experiences

Success stories

What our clients say about us

Companies that trust our solutions

Answers from our experts

What causes data loss in VHD and VHDx virtual machines?

The most common problems involving data loss in VHD and VHDx type files are:


Because the Windows Recycle Bin has a limited space for deleted files (around 5% of available disk space), when a large file is deleted it is usually not stored in the Recycle Bin. Therefore, it will not be possible to go to the Recycle Bin to try and recover the file as it will not be there.

The solution to this problem can be solved by finding the MFT (Master File Table) of the deleted file and retrieving it. There is some software on the market that can do this. However, in some cases the MFT is also deleted. When this happens inevitably it will be necessary the intervention of a professional specialized in the area of data recovery.

In some cases data recovery software can even find a file with the same name or size as the file that the user wants to recover, but most of the time this file has serious corruption problems. It is likely that the file is fragmented (sometimes with thousands of fragments) and not being able to access the partition metadata it may not be possible to reconstruct it by data recovery software.


Partitions are like giant mathematical equations with thousands of variables managed by the software that is the operating system. This giant mathematical equation allows users the fantastic experience of storing and removing information in the digital age.

Partition systems can run perfectly like clockwork for years without any problems happening. However, hardware failures, electrical problems, or even human error can cause one of the cogs in this fantastic clock to break causing unpredictable problems that the operating system will not know how to fix.

In cases of partition system corruption the operating system will try to repair the problem. To do this it triggers a process to check the disk and the partition.

In most cases the problem is solved, but in some more serious cases the system may not be able to catalog all the necessary information of one or another file and simply write zero bytes in a file that before was with thousands of extremely important information. In our point of view, writing zero in the size of a file that contained important information is a very serious failure of the operating system.

In an attempt to solve the problem the operating system ends up worsening even more a problem that was already quite serious. In this case it is unlikely that any data recovery software will be able to reverse the problem.


Ransomware attacks have become so common that it is practically impossible for an IT technician not to know the story of some company or professional who has already suffered with this.

The attack consists of breaking into computers, encrypting the data and then demanding a ransom. In other words, hackers invade your computer, encrypt your information with a gigantic password and then contact you asking for money to release the password to unlock your data.

When this happens there is not much you can do if you don’t resort to backups that unfortunately are often encrypted by hackers. The other alternative is to pay the hackers to get the encryption password. Besides the decryption process is not simple even when you get the password, it’s very hard to believe that when you make the payment the hacker won’t ask for more money. Unfortunately we know several stories like these.

If you happen to have been attacked by ransomware and need help, please consult one of our experts. We have developed several studies in this area and have already managed to recover numerous cases of virtual machines (VHD, VHDx and VMDk) attacked by Ransomware.


Can a snapshot replace a backup?

Absolutely not, the snapshot is not a backup! We have attended many cases where the customer believed this, so it is valid to make clear what the snapshot actually is.

The snapshot is a kind of freezing of the virtual machine matrix and the creation of a new virtual machine, which will be tied to the matrix, but without using it. The new data is recorded without consuming the space and performance of the matrix virtual machine.

In these terms the snapshot may look like a backup, but in no scenario can it be used as such. It is recommended that a backup of the data is always available.

Are there any recommendations for the use of Snapshots?

Yes, there are some best practices that need to be taken into account, they are:

  • Use Snapshot for maximum 72 hours, after that it is recommended that the data is consolidated on the parent virtual machine.
  • The Snapshot should not be too big, its size influences the time of the data consolidation process.
  • Do not have more than three Snapshots.

Latest insights from our experts

Ransomware AtomSilo

AtomSilo Ransomware

The AtomSilo ransomware emerged in September 2021, the group acts a little differently than other ransomware groups, the ransom amount is fixed, $1 million is

Khonsari Ransomware

Khonsari Ransomware

The Khonsari ransomware was the first group to exploit known Apache Log4j vulnerabilities (CVE-2021-44228 and CVE-2021-45046), the group has focused its attacks on Windows servers that


What you need to know

We have a thorough knowledge of the main virtual machines on the market, as well as exclusive technologies that enable us to recover data regardless of the reason for the data loss.

Our technologies allow us to recover data from the following virtual machines

  • Microsoft Hyper-V
  • Oracle VirtualBox
  • VMware
  • Citrix
  • Acropolis
  • Microsoft Virtual PC
  • QEMU

It is not possible to establish a price without first diagnosing the affected virtual machine, we can make an in-depth diagnosis in the first 24 hours, after that we provide the budget.

It is worth remembering that payment is only made after the recovery process has been completed and after the verification of the recovered files made by the customer himself.