He utilized a scavenging algorithm to scan for a backup boot sector. NTFS was resilient; it kept a copy of the boot sector at the end of the volume. If he could find that, he could reverse-engineer the start point.
# Disk DescriptorFile version=1 CID=12345678 parentCID=ffffffff createType="vmfs" corrupt vmdk recovery