Hardware and RAID configuration:
The customer has a FreeNAS 9.3 system with 3x3TB hard drives in RAIDZ1 configuration.
A share holding 2TB of data was deleted from the system. The last backup of the share was 2 years old.
The customer needed to recover digital photos (CR2s, JPGs, TIFs, ...) created or modified in the last 2 years.
File names and folder structure were not important.
We came up with the following procedure to recover the deleted data:
- Scanned the drives for FSO (File System Object) dnodes.
- Filtered out file system dnodes, intermediate dnodes (ZFS uses Copy-On-Write.
As a result, multiple dnodes are created when a file is created or modified), and files with modified date older than 2 years ago.
- Used the info in the dnode to read the header of the files.
- Used the header to filter our irrelevant files and recovered only digital photos.
We were able to recover 95% of digital image files for the customer.