VMDK Recovery guide

SEsparse VMDK Recovery

Last updated: October 11, 2026

SEsparse VMDK recovery can help extract guest files when the relevant virtual-disk components are still accessible. The objective is to extract files from SEsparse snapshot evidence or restore data from its related VMDK components to a separate healthy destination.

On ESXi, SEsparse is a space-efficient snapshot redo-log format within a snapshot chain. Its redo-log data is stored in a single -sesparse.vmdk file for that snapshot disk; a descriptor may be a separate companion, and the snapshot can depend on its parent. This is not a numbered split-disk set. A hosted split VMDK is a different layout stored in numbered extents. Each requires a different evidence check before scanning. This is guest-file recovery, not in-place repair or a way to restore or boot a complete virtual machine.

Short answer: Preserve every accessible related file with its original name and location. Continue only when the files are available locally or exposed by an ESXi host through SFTP, use a read-only virtual reconstruction, and validate representative results before export.

Check the component matrix before selecting a source. Stop when a dependency is missing, a usable virtual view cannot be formed, or the required result is a working VM. Recovery is not guaranteed.

Protect the Source and Confirm Recovery Prerequisites

Before opening any VMDK component, make a go-or-no-go decision from observable evidence. Preserve all available components together and record their original names, paths, observed sizes, and timestamps where available.

SEsparse VMDK recovery preflight checks
Preflight checkContinue whenStop when
Source protectionEvery available source component can remain read-only throughout the attemptA mount, application, or process may rename, move, overwrite, or otherwise change the source
Available evidenceThe intended SEsparse snapshot component or complete available hosted split set can be identified without guessingA required descriptor, parent, extent, or other dependency is expected but unavailable
Stable accessLocal access or an SFTP connection to the ESXi host is stable enough for a scanThe source disconnects, changes, or is exposed only intermittently
Free spaceA separate healthy destination has enough capacity for selected recovered filesExport would have to use the source storage or another unsafe destination
Recovery objectiveThe objective is to recover guest filesThe objective is in-place repair, writing replacement components to the source, snapshot consolidation, or a bootable VM

DiskInternals Recovery Engine attempts a virtual recovery view and relationship tree using accessible descriptor, snapshot, split, flat, and parent files. It does not alter the originals or rewrite a descriptor, header, CID, or extent table. It cannot recover data blocks or sectors absent from the available files, recreate arbitrary missing metadata or components, or guarantee a complete chain or result.

Accessible files

Local files or files still exposed by an ESXi host can be inventoried.

File-level SFTP

It opens exposed files but does not parse VMFS; VMFS Recovery handles sector-level datastore recovery.

Healthy destination

Licensed export must use separate storage with sufficient free space.

Do not scan a partial set, export to source storage, treat preview as a full-recovery guarantee, or continue after a dependency stop condition.

SEsparse VMDK Recovery: Identify the Available Components

A VMDK can include metadata and data components. A name or extension alone does not prove that dependencies or underlying data are complete. Classify what is actually accessible before deciding whether to scan.

Accessible SEsparse evidence

Evidence: An SEsparse snapshot redo-log file and its required, identifiable parent and descriptor components are accessible.

Decision: Proceed conditionally with the SEsparse workflow below; accessibility does not prove completeness.

Next: Preserve the entire available set and continue only if it can be identified without inventing a relationship. Its snapshot role alone is not a reason to change routes.

Available split VMDK set

Evidence: All expected accessible split extents remain together.

Decision: Proceed conditionally; the segments are one evidence set.

Next: Confirm the sequence and follow the split-set checks below.

Missing or unusable descriptor

Evidence: A required descriptor for the SEsparse snapshot or another disk component is unavailable or unusable.

Decision: Route first; do not create or edit metadata here.

Available flat extent

Evidence: A flat extent is available without a usable descriptor path.

Decision: Route first for a dedicated evidence assessment.

Broader snapshot-chain troubleshooting or other delta cases

Evidence: The case requires assessing a broader snapshot chain or other delta components beyond the identifiable SEsparse set covered here.

Decision: Route to the snapshot-chain assessment. An accessible SEsparse set with its required parent and descriptor remains eligible for this page's workflow.

Next: Use VMDK Snapshot Recovery for that broader assessment.

Deleted or host-missing container

Evidence: The VMDK container was deleted or is no longer exposed by the ESXi host.

Decision: Stop this accessible-file workflow; it cannot open a file the host no longer exposes.

Component no longer exposed from VMFS

Evidence: A required component is no longer exposed by the ESXi host.

Decision: VMDK Recovery opens files the host exposes through SFTP but does not parse VMFS or search deleted datastore space.

Next: Use Recover a Deleted VMDK From a VMFS Datastore; VMFS Recovery handles sector-level datastore recovery.

Complete virtual-machine outcome

Evidence: The required result is a restored or bootable VMware virtual machine.

Decision: Choose a different recovery objective; recovering a VMDK or guest files does not restore the complete VM configuration or prove that the VM can boot.

The first two cards are the only bounded scan cases covered below. The remaining cards are stop or route decisions. If a sparse VMDK header is reported as corrupt, do not edit it to test a scan. If an SEsparse .vmdk file was deleted or is no longer exposed, stop this workflow for accessible files.

Split VMDK Recovery: Keep Every Extent Together

A split VMDK stores one virtual disk across multiple extent files. Those extents are one evidence set, not independent disks. Recover split VMDK files only after confirming that every expected accessible extent remains together in its original sequence and location.

  • record filenames, paths, and observed sizes without changing them;
  • do not select one extent in isolation;
  • do not rename parts to close a numbering gap;
  • do not move components into a new layout or edit metadata around an absent member.

If an expected extent is missing or inaccessible, stop this split-set workflow and preserve what remains. Virtual reconstruction can attempt to establish relationships from the accessible components, but it cannot recover data blocks absent from them or guarantee a complete result. Return to the component matrix and choose the decision that matches the observed evidence.

Recover Files with DiskInternals Recovery Engine

This sequence is for guest-file extraction from accessible SEsparse snapshot evidence or a complete available hosted split set. The free evaluation can scan and preview supported files. A license is required to export selected files to a separate healthy destination.

Each stage has an observable check and a stop condition. If evidence becomes incomplete or the application cannot form a usable virtual view, preserve the source and return to the component matrix.

Inventory the Available Evidence Before Opening It

Treat the inventory as an evidence log, not as a list of files you expect to be related. Record what is actually visible before opening any component in recovery software.

Prepare three separate roles
Source, recovery environment, and destination roles
RoleWhat belongs hereWhat must not happen
Source evidenceThe untouched accessible VMDK files or a protected working copy of the complete available setDo not install software, save sessions, rename components, or export recovered files here
Recovery environmentA healthy Windows system running DiskInternals Recovery EngineDo not confuse its program or temporary folders with the source or export destination
DestinationSeparate healthy storage with enough space for the selected recovered filesDo not use the affected datastore, source folder, or another location on the same unsafe storage
Build the evidence log in order
  1. Define the objective. Record the guest-file recovery goal and identify the intended virtual disk or virtual machine by a name meaningful in the current environment.
  2. Record visible files. Copy the exact name, extension, original directory, observed size, and timestamp of every accessible related file. Preserve capitalization and numbering exactly.
  3. Record access. Note whether the source is local or exposed by an ESXi host over SFTP. For remote access, record the host and source directory.
  4. List dependencies. Note each descriptor, parent, extent, snapshot, delta, or other dependency indicated by the available evidence, including anything expected but unavailable.
  5. Classify the source. Use observable evidence to identify an accessible SEsparse set, a complete available split set, or an out-of-scope state from the matrix.
  6. Prepare the destination. Record the physical destination, free space, and folder that will receive licensed exports.
VMDK dependency chain from metadata and extents to a virtual recovery view

Swipe or scroll horizontally to read the diagram. Use arrow keys when focused.

Inventory every accessible relationship. Missing blocks are not invented during virtual reconstruction.
Make a written go-or-no-go decision
SEsparse and split VMDK inventory decision
DecisionRequired evidence
Go: accessible SEsparse snapshot redo-log fileThe intended SEsparse snapshot component, its required identifiable parent and descriptor, and every accessible related file are preserved together; no required known dependency is missing. Its snapshot role alone is not a reason to change routes.
Go: complete available split setEvery expected accessible extent is present in the original sequence and location; the set can be identified without renaming or guessing
No-go: incomplete or uncertain evidenceA descriptor, parent, extent, or other expected dependency is unavailable, identity is uncertain, or one file is being treated as proof of a complete disk
No-go: different outcomeThe objective is in-place repair, an undeleted datastore component, snapshot consolidation, or a restored and bootable VM

Observable check: The intended source set can be identified from available evidence without relying on an extension alone or guessing a missing relationship.

Next: Record go only when the evidence fits one of the first two matrix cases. Otherwise record no-go and use the matching route there.

Stop: Do not open the source when a required component is unavailable, source identity is uncertain, files are changing, access is unstable, or the objective is a complete VM. Preserve the evidence log with the source set.

Start a Read-Only Virtual Reconstruction

Install and run DiskInternals Recovery Engine from the healthy Windows recovery environment, never from the affected storage. Work with the protected local evidence or connect only to files that an ESXi host still exposes over SFTP.

Keep three objects distinct
Source set, virtual recovery view, and destination distinction
ObjectMeaningSafe check
Source setThe preserved accessible SEsparse snapshot evidence or complete available hosted split setNames, paths, sizes, and access method match the inventory
Virtual recovery viewThe in-app reconstruction formed from available evidenceIt appears inside the application and does not replace or update source files
Export destinationThe separate healthy storage prepared for licensed outputIt is not inside the source folder or affected datastore

Select the intended source through the normal VMDK-opening flow and compare it with the inventory before scanning. Confirm the path, visible filenames, observed sizes, and access method. When several virtual disks or similarly named directories exist, stop and resolve identity from environment records instead of choosing by filename alone.

DiskInternals Recovery Engine uses available evidence to form a virtual recovery view inside the application. This is not an in-place repair and does not modify the original files.

VMDK Recovery connects through SFTP to an ESXi host, opens an accessible VMDK as a disk in the program, and scans its guest file system

Swipe or scroll horizontally to read the diagram. Use arrow keys when focused.

VMDK Recovery opens files exposed by the ESXi host through SFTP, but it does not parse VMFS or search deleted datastore space.

For remote source files, VMDK Recovery opens files exposed by the ESXi host through SFTP, but it does not parse VMFS or search deleted datastore space. If a required component is no longer exposed, use VMFS Recovery for sector-level datastore recovery.

Checkpoint before scanning
  • the selected input matches the source set recorded in the inventory;
  • the application is not pointed at the destination or an unrelated VMDK;
  • every accessible related component remains in its preserved location;
  • the source remains stable and unchanged during access;
  • the application presents a plausible virtual disk or guest file-system view rather than only an isolated unclassified file.

Observable check: The application identifies a plausible virtual disk or guest file-system view that corresponds to the intended source.

Next: Continue only while the source remains unchanged and the in-app view remains consistent with the inventory.

Stop: Stop if a dependency is unavailable, access becomes unstable, the source cannot be identified, or no usable virtual view can be formed. Do not edit a descriptor, header, CID, extent name, or path to force the view to open.

Scan for the Guest Files You Need

Define a small representative target set before scanning. Include important files from different folders and types whose expected content or approximate size is already known. This gives the scan a practical success criterion other than a large result count.

Representative guest-file target record
Target recordUseful evidence
Expected folder or pathThe known project, user, database, or application-data location inside the guest file system
Representative filename or patternA known document, archive, database, media file, or filename family
Expected type and approximate sizeEnough information to distinguish the intended file from unrelated results
Expected date or versionA known period or revision where guest metadata remains available
Validation methodPreviewed content, archive listing, media playback, or later application-level opening after export

Start a scan only from the usable virtual view. The free evaluation can scan supported guest files, but discovery in a result list does not prove that a file is intact or exportable.

Read-only VMDK source, virtual reconstruction, and supported file preview flow
Scan and preview are evidence stages. Licensed export remains a separate decision.
While the scan is running
  • keep the source set and remote access path unchanged;
  • do not move, rename, replace, or add components to alter the result;
  • do not start a second competing scan against the same evidence;
  • record disconnects, read errors, path changes, or a changing result context;
  • compare emerging folders and files with the representative targets instead of judging only by item count.
Classify the scan result
SEsparse VMDK scan result classification
Scan statusMeaningNext action
Plausible matchSeveral expected folders or representative files appear in context consistent with the intended guest diskContinue to representative preview
Partial or uncertainSome expected items appear, but paths, sizes, dates, or surrounding content do not agree consistentlyRecord the mismatch and preview a wider representative sample before any export decision
Mismatch or no usable resultExpected content is absent, results belong to another disk, or the virtual view is internally inconsistentStop and return to the evidence inventory and component matrix

Observable check: Record whether representative needed folders and files appear with plausible names, locations, apparent sizes, and dates where available.

Next: Select a representative sample across different folders and file types for preview. Favor files whose expected content is already known.

Stop: Stop if results are absent, unrelated, internally inconsistent, or if access changes during the scan. Do not edit or swap source components during the same session.

Preview, Validate, and Export to a Healthy Destination

Use the free evaluation to preview representative supported files before deciding whether to license an export. Preview several results rather than relying on one easy-to-open file.

Use at least six evaluation signals
  1. Previewed content. The supported file opens and shows the expected text, image, document, archive, database fragment, or media content.
  2. File size and type. The apparent size and detected type are plausible for the expected file.
  3. Directory context. The file appears with folders and neighboring files that belong to the intended guest system.
  4. Dates and versions. Available timestamps or revision details are consistent with the expected period.
  5. Content-to-name match. Previewed content belongs to the filename, project, user, or application context shown.
  6. Multiple samples. Files from different folders and formats produce a consistent picture rather than one isolated success.
Representative preview classification
Preview statusMeaningDecision
PromisingSeveral representative supported files open and contain the expected contentPrepare a selected export to the healthy destination
UncertainMetadata looks plausible, but preview is unavailable, incomplete, or inconsistent for important filesExpand the sample and keep the result unverified
ProblematicPreview is truncated, corrupt, mismatched, or unreadable across important samplesStop; do not treat licensing or export as a repair step

Preview supports a recovery decision. It does not guarantee that every file is complete, intact, or exportable.

One-way flow from read-only VMDK source through an in-app recovery view to a healthy destination
Keep the workflow one-way: read-only source, in-app reconstruction, separate healthy destination.
Reconfirm the destination before export
  • it is separate from the affected source and datastore;
  • it is healthy and reliably connected;
  • it has enough free space for all selected files;
  • its destination folder is clearly identified;
  • it will not overwrite source evidence or an earlier verified recovery set.

After licensing, export only selected files to that destination. Keep the exported set separate from the untouched source and unverified earlier attempts. Record the export folder and preserve available scan or session information needed to understand how the result was produced.

Export completion is not the final check. Open representative recovered copies from the destination with the applications that normally use them. Include small and large files, archives, databases, media, and application-specific formats where they matter. Check complete playback, archive extraction, document content, database or project consistency, and known checksums or trusted originals where available.

Classify the saved result
Exported recovery result classification
ResultDefinition
VerifiedThe exported file opens independently and passes the relevant content-level checks
Partially verifiedSome content is usable, but completeness, dependencies, or application integrity remain uncertain
UnreadableThe exported copy does not open correctly, is clearly incomplete, or does not match the intended content

Keep the source unchanged until important files have been verified and copied to at least one additional safe location. If representative exports fail, retain the evidence and recovery notes rather than repeating the attempt after modifying source components.

Observable check: Representative previews match the target set, the destination is separate from the source, and representative exported copies open independently after licensed export.

Stop: Do not export if the destination is the affected source, lacks capacity, or is not healthy. Stop after export if representative copies are missing, unreadable, or inconsistent with preview. Unresolved dependency, access, VMFS, or complete-VM conditions return to the matrix.

Frequently Asked Questions About SEsparse and Split VMDK File Recovery

Start SEsparse VMDK Recovery
Install the free evaluation on a healthy Windows drive, keep every source component read-only, and scan the accessible evidence. You can preview supported guest files before choosing a license.
After licensing, export selected files to a separate healthy destination. Do not write recovered data back to the affected source.