Ever hear of DblSpace (dos hard drive compression)? Maybe you heard of DrvSpace? I know, how about Stacker, everyone has heard of Stacker. No? Well if you haven’t heard of these it might be because these file system handlers were used in the heyday of MS-DOS 6.??. These file systems and handlers were used to compress a file system and its accompanying data for a FAT32 or FAT16 partitioned volume. The way it worked is a Virtual Disk was made using a very large file. If you had a hard drive that was one hundred megabytes you could in fact expand that hard drive to one hundred and fifty megabytes simply by using the DblSpace tools. The large file was given a drive letter and all data that was saved to and read from the volume passed through a compression algorithm and was then passed to the drive. This method worked very well, unless you lost the configuration and then the hard drive would disappear, along with your data and everything else.
Years ago I wrote data recovery software that would parse the Dblspace virtual file. The good thing about a dblspace file was that the actual FAT and File Entry Tables were never compressed. All one had to do was load the FAT, spin through the File Entry list and build a tree. The compression algorithm was pretty straight forward and I embedded that into the software so I would decompress the data as I copied it from the dblspace drive.
I suppose you are wondering how this applies to VMWare. Well, it’s pretty simple. Each VMWare volume is in itself a large file. There are static volumes and virtual volumes. If you have a 20 GB virtual machine then you would in fact have a 20 GB file on the hosting machine. These ‘VMDK’ files ‘Virtual Machine Disk Format’ is where all of the data is stored. These files if configured as static can in fact be mounted by any piece of data recovery software as a volume. They are in affect a dblspace drive without the compression.
I have on more than one occasion mounted a client’s vmdk file and recovered all of their data for them with our in house software. If the vmdk file is virtual then it is much more difficult to recover as the file is compressed, the file system components are not in their right places and it is hard to piece together a file system.
Still all of this being said, DblSpace, Virtual Machine Disk Format, and all the other flavors of virtual disk handlers off a unique perspective into the layout of a file system and ultimately a challenge for data recovery
