I got hit by ransomware and during the decryption process that disk got full and the VM stopped and couldn’t;t start with an error related to the disk. I wanted to expand the size of the disk but didn’t work due to snapshots are made on this VM. after some readings on the internet I found on forums that in order to expand you have to delete all snapshots and I did so and still can’t expand the disk size. I tried to run VM and it is running an old snapshot or the original VMDK and all the files are not up to date.

I browsed the VM Datastore and found many sub-vmdks (child-vmdk files) but I don’t know how to use them or consolidate them. I opened again the snapshot manager and found nothing.

my questions are:

1- how can I run the latest child-vmdk? I need to access the latest files on the VM

2- How can I consolidate manually the child-vmdsk with the parent-vmdk?

3- Can I mount the latest child-vmdk on a new Windows OS and do you think I can find the latest files on this child-vmdk?

please advise.