When I sat for a chat with its VMware guru, the first story they told wasn't strictly speaking specific to VMware at all: It was rather a harrowing tale of staggering hubris and poor negotiative skills which prominently featured an IT "professional" effectively holding his employer to ransom by simulating storage failures. It wouldn't have mattered if they were using Hyper-V, or Netware, or a stack of Hollerith cards: it's actually a superb example of the way humans mis-use various types of technology, rather than an illuminating case study of a shortfall of the technology itself.
The second example again falls into an area which I would have labelled as "systems management" more than "data recovery." Professionals working entirely inside the feature set of VMware vSphere have failed to RTFM when it comes to the nature and behaviour of VM snapshot files. These can produce sudden and unexpectedly full disks, which can't naturally be emptied without a good deal of pain and anguish, and which often give off errors and statuses which don't directly relate to the genesis of the problem.
The Kroll drive-imaging methodology makes this relatively easy to fix, though I was intrigued by just how it estimates the timescale required to run a given job through its recovery systems, given that most of the kit I saw there was at least, recognisably consumer-grade and therefore unremarkable. Most of those Coolermaster cases for instance were showing Windows XP screens, albeit with Kroll's own forensic software running on it.
The most telling VMware-specific snippet I gained in a short visit, though, wasn't strictly speaking a war story: It was an aside, about the balance of cases in which one of the engineers from Kroll goes onsite, as distinct from a stack of drives turning up in the post.
The virtual computing team seemed to have a slightly greater bias towards travel than the other, more traditional teams. This is mainly because their workload is not nearly so much about smoke escaping, or the echoless crackle of a bent smartphone. Indeed, in a virtual world, it's far more about keeping track of the features, the Thin Provisioning and the remote storage and the deduplication and all the other hot buzzwords that infest virualised data centres.
This redefines the job of a data recovery engineer, away from drying out soaked circuitboards or recovering Master File Tables and more towards remote admin sessions, travelling with a tiny USB key of commerciall confidential utilities and just occasionally telling the boss it was a hardware problem, to save the nerd's skin.
