ZFS Pool Recovery from Dell^® PowerEdge R710 RAID Z

Problem Statement

Recover data from the inaccessible and corrupt ZFS pool volume that showed file system error message — ‘Metadata Failed while Importing ZFS Pool’.

Data Recovery Challenges

• Repair corrupt ZFS pool volume
• Extract readable data from ESXi volume containing multiple VHDx files

Remote Data Recovery Approach

Stellar^® assigned a specialized team of RAID experts to execute this project. The team employed the following steps to recover ZFS pool volume data:

Step 1: Hard Disk Examination & Diagnosis

• Stellar^® RAID data expert team performed an online examination of the RAID Z hard disk drives for Raid Z Recovery. To facilitate the online analysis, the Stellar^® data recovery technician emailed a secure remote access application link to the client organization to map the client system with Stellar’s server. The client accessed the link through its computer to establish the remote connection.
• After analyzing the four RAID HDDs, the team found that the hard drives’ health was up to mark, but there was corruption in the ZFS storage pool volume with broken inode links.

Note: The inode is a numbered data structure in a ZFS file system. It describes a file-system object and stores the attributes (that contain metadata, owner, and permission data) and disk block locations of the object's data.

The team concluded a logical corruption in the ZFS volume, due to which the data was inaccessible.

Step 2: Disk Imaging

• The next step was to create an image of the corrupt ZFS volume to facilitate the data recovery process. The team used a Hex editor tool to create an image of the corrupted ZFS volume.

Step 3: Rebuild ZFS pool

• Data recovery was not possible from the corrupt volume. So the next step was to repair the ZFS pool. It was a tedious task as the team had to rebuild the broken inodes of the ZFS pool volume manually. It took about two weeks to reconstruct the ZFS volume and reinstate it to a functional state.

Step 4: Deep Scan and ZFS Data Recovery

• After reconstructing the ZFS volume pool, the team performed deep scanning on the rebuilt ZFS pool volume.
• A byte-wise scanning of the ZFS volume image file revealed the presence of the NexentaStor 4.0.3 operating system.
• The scan results showed VMware ESXi hypervisor volume of 5.5 TB capacity having 25 VHDx files. The actual data required by the client was inside these VHDx files.

Stellar^® RAID data recovery expert team was able to extract approximately 12.2 TB data from the highly compressed VHDx files. The data comprising SQL files, PDFs, Word documents, Excel, PowerPoint files, images, videos, etc., was recovered in the readable format with the original file name.

Result

Stellar^® RAID data expert team recovered 100% data from the ZFS-based RAID Z deployed on the DELL R710 server. It restored the files to their original form and shared a detailed assessment and recovery report with the client organization. Stellar^® team completed the entire RAID Z data recovery assignment within the specified time. Stellar^®, an ISO 9001:27001 organization, maintained a strict adherence to ISO process standards for ensuring the confidentiality, security, privacy of the client’s data.