Data recovery and disk repair questions and discussions related to old-fashioned SATA, SAS, SCSI, IDE, MFM hard drives - any type of storage device that has moving parts
April 29th, 2023, 12:34
Hello everyone!!
In the last few days, we received a ZFS RAID6 storage system composed of six 4-terabyte hard drives. It's important to clarify that the RAID was not created by ZFS, but rather by a RAID controller that created a volume, and on this volume, apparently three ZFS pools were created. According to the customer's report, the only measure he took to restore the RAID's operation was to replace the server's physical controller. The operating system is FREEBSD 11.
Five of the six disks are working perfectly, but one of them has a SMART alert, even though no damaged sectors were found in the clone we performed. We used Recovery Explorer as the first tool to work with the RAID, which automatically found a RAID6 configuration and displayed two functional pools. Recovery Explorer allowed the exploration of the file structure, as well as the extraction of functional files larger than the block size used to mount the RAID (64KB).
One of the displayed pools is 8GB, and everything indicates that it allocates the operating system. The other displayed pool is 112GB, and the file structure is like that of a Unix operating system, but incomplete because some folders are missing. What we're looking for is a third pool that would occupy the remaining space on the volume, which, according to the customer, would have between 10-12 TB of data.
Despite attempts to scan with Recovery Explorer to find the missing pool, we were unsuccessful. We performed scans both in a limited space of 200-400GB after the 112GB pool and in a complete search of the volume, but we did not find the missing pool.
Therefore, we worked with Reclaime Pro and had their team's support. They helped us find a valid RAID6 configuration so that we could scan the volume found. In the regular scan, we did not find any folders belonging to the lost pool, and almost all the folders showed files without extension during the scan. In RAW, we found several intact files with a size of 40Mb; however, the majority of the data found in RAW is invalid and corrupted. We believe that one of the obstacles in this case is the number of files. In a scan of approximately 70% of the RAID image in RSTUDIO, more than 100,000,000 files were counted, with the majority being corrupted/broken. We are thinking that ZFS could be with compression enabled in this volume based on the RAW result we obtained.
In another process that ReclaimePro support tried to do, the procedure in the "Find ZFS" menu, we never managed to get past 60% progress, as usually after 50%, the program starts consuming almost all of the computer's memory, and disk activities decrease to nearly 0%. After several checks by their support, analyzing the program logs, it was reported that it was not possible to find metadata from the lost pool on this RAID.
As we found some still functioning files, we have hope that recovery is possible. I wanted to share this case to have some type of feedback, even if it means concluding this case unsuccessfully.
I apologize for the length of the text, but I tried to provide as many details as possible. I greatly appreciate any contributions.