Maya grabbed coffee and her battle-tested Linux VM with vmfs-tools compiled. First rule of VMFS recovery: do not write anything to the affected LUN . She used a rescue Linux live CD on a physical host with HBA access.
Step 4: She used dd to copy that backup block over the primary superblock (after making a full LUN image with ddrescue to a separate 12-TB drive—insurance). # dd if=/dev/sde1 bs=1M skip=512 count=1 of=primary_superblock_backup.bin Then, using vimfstools (from a recovered ESXi maintenance mode session): # vmkfstools -B recover /vmfs/devices/disks/naa.6000...:1 recover vmfs datastore
She logged in. Heart sank. The 12-TB VMFS volume—hosting a real-time fraud detection system—wasn’t just offline. It was gone. ls -la /vmfs/volumes/ showed only the local datastore. Someone (an intern following an outdated runbook) had accidentally zapped the LUN mapping from the SAN side, then re-presented it—but as a new device signature. Maya grabbed coffee and her battle-tested Linux VM
Step 3: Deeper scan. She ran vmfs6-recover (part of vmfs-tools ). It parsed backup VMFS metadata—the first copy of the file system descriptor had been overwritten when the host re-scanned the "new" LUN, but VMware stores a second copy at offset 512 MB. Step 4: She used dd to copy that
VMware now saw the storage, but as a fresh, unmounted volume. The partition table? Intact. The VMFS superblock? Unknown.