Zombie files and Leftover VM on Datastore

Products

• VMware vCenter Server

Issue/Introduction

Locate and verify if a file is left over and no longer in use and can be removed.

Environment

ESXi 7.x and above

Cause

Large number of files remain after vm deletions. 

Attempt to identify which files can be permanently removed.

Resolution

1. List All Files and Directories on the Datastore

SSH into the ESXi host and list all contents:
ls -lh /vmfs/volumes/<datastore_name>/

To list everything recursively and see sizes:
find /vmfs/volumes/<datastore_name>/ -type f -exec ls -lh {} \; | sort -k  

Replace `<datastore_name>` with your actual datastore name or its UUID path.

 

2. Check for VM Directories Not Registered in vCenter

ls /vmfs/volumes/<datastore_name>/ > vmfs-folders.txt
Compare this list with the registered VMs.

 

3. Identify Orphaned `.vmdk` Files

Run this to find `.vmdk` files not referenced by any registered VM:
find /vmfs/volumes/<datastore_name>/ -name "*.vmdk" > /tmp/vmdk-list.txt

Then check for registered VMs that use them:

grep -i "$(basename <file>.vmdk)" /etc/vmware/hostd/vmInventory.xml

If a `.vmdk` is **not listed anywhere**, it’s likely orphaned.

4. Check for Old Snapshots

Sometimes leftover snapshot delta files remain:

Run this command to search for all of the virtual machine configuration files seen by the ESX and check if there is a file which looks like a snapshot disk:
find /vmfs/volumes/ -iname "*.vmx" -exec grep -HEie "-[0-9]{6}.vmdk" {} \;

Any `*-delta.vmdk` not tied to a current VM should be investigated.

5. Check the vmdk's  to see if it is orphaned.   

vmkfstools -i /vmfs/volumes/<datastore>/vm-folder/yourdisk.vmdk -d zeroedthick /tmp/test.vmdk

If it errors out or shows corruption, it’s likely orphaned.

##IMPORTANT
Never delete files unless you're **100% sure** they are not in use.

You can:

**Rename** suspected orphaned files (e.g., add `.old`) and observe.

Use **vCenter > VM > Edit Settings** to see what disks are attached.

To Delete Leftovers (When Confirmed)

rm -i /vmfs/volumes/<datastore>/vm-folder/*.vmdk

Or remove entire orphan folders:

rm -r /vmfs/volumes/<datastore>/orphan-folder