thanks for your response André, I really appreciate your help
attached are screen shots of the datastore (250GB drive holding the VM with Windows Server 2008 on it) and DISK_1 which is what I thought was holding the second 1TB disk drive and is data only.
I traced the time to about 18:30 on 21st when I disconnected the hard disk DISK_1 and then ran export on the VM datastore disk, and then reconnected it at about 19:50 which is the time stamp on the vmdk disk in DISK_1 screen shot. It looks like it is sticking to that time as the last modified time too which is what I noticed before seeing the 2nd of Feb on it. I am guessing the same thing will happen again if I disconnect it.
am I right in thinking it is for some reason now storing the data on the 250GB datastore disk and not really actually on the 1TB disk, what's that about?
for the record I recall running out of space around Feb 2nd due to snapshots and I learned that they grow, I hadnt been aware of that prior to finding the server crashing and had to delete all the snapshots and restart the machine. I am not sure if I made any setting changes at that time it would have been based on support I searched on the problem.
I need to rename this DISK_1 vmdk as well, as it is confusing since I named both disk instances 'windows server 2008' but right now I am a bit lost with what I am looking at, so any advice on proceeding would really help.
I am about to start the process of replacing all the data on the DISK_1 with the backup data I made from within Windows beforethis happened as I need to have their data back by monday AM. luckily it is only about 80 GB, but I need to get this done so will start that process today.
Is there a better way to export a copy of the current VM on its own without the DISK_1 data, and without having to disconnect the DISK_1 for future reference?
I have also included the vmware logs from around the time it occured
thanks again André
rgds
Mark