Have you ever browsed the directory of a virtual machines datastore and wondered what are all the files in the directory? What do they do, what do they mean, and which ones could I live without and still recover a functioning virtual machine.

The answer can be long and complicated, but I’m going to attempt to answer it today, and over the next few days will attempt to go into more detail on the meanings of each file, and what (if anything) you might find of value inside each file.

I took a snapshot of this VM prior to taking this screenshot, in order to show the majority of files that are important.

Here is a brief run down of of all the files here

  • vmware.log
    • This is the current log file for this VM. If the machine is running, this is where ESX is logging to, if the machine is stopped or suspended, this is the most recent log.
    • The VMware-#.lgo are log files from previous instances of this machine, a new log file is created each time the VM is started, be it power on, resume (from suspend), or vmotion.
  • .vmx and .vmxf
    • These files contain the configuration information for the VM, including: memory size, hard disks, CDROM information, network configuration etc.
    • You can sometimes add directives to these files to take advantage of interesting, and sometimes undocumented features – similar to what I discussed regarding using alternate datastore for snapshots
  • .vmsd
    • This is essentially the snapshot database, it contains information regarding all current snapshots, or if there are not current snapshots, the most recent one.
  • .vmsn
    • This file contains the memory state of a VM at the time a snapshot was taken, do not confuse this with the .vmss file described below
  • .vmss (not pictured)
    • This file contains the memory state of a Vm at the time it was suspended.
  • -flat.vmdk
    • This file is the physical file that contains that actual data stored on the drive of the VM. There is one for each drive attached.
    • By default this is a thickly provision file on SCSI volumes, thinly provisioned on NFS.
  • -delta.vmdk
    • This is a thinly provisioned “flat” vmdk, that is a log file for the .vmdk it is a child of. It is allocated in 16MB heaps, and can only grow as large as the parent disk. There will be one -delta.vmdk per drive, per snapshot.
  • .vmdk
    • This is a plain text descriptor file, that describes the characteristics of the “flat” vmdk, it contains information such as the SCSI device type, geometry, provisioning type, etc.
    • There is one for each hard disk attached to the virtual machine
  • -######.vmdk
    • This is the plain text descriptor file, that describes the characteristics of an associated -delta.vmdk.
    • There is one for each physical hard disk per snapshot
  • .hlog
    • This file is a brief logfile that helps track migrations
  • .nvram
    • This file contains the systems BIOS NVRAM data.

Hopefully, this provide some insight into the make up of a virtual machine. Tomorrow or the next day I will dive into the .vmx and .vmxf files.

Until then!