Using Klennet ZFS Recovery

Klennet ZFS Recovery does not have any configurable options. The recovery process is as follows:

  1. Setup hardware/software for recovery,
  2. select source drives, select what to look for, and click Start,
  3. wait for the scan to complete,
  4. select what you need from the output (interpreting output is complicated and I have a dedicated howto for it),
  5. copy the files out.

Hardware and software setup

Klennet ZFS Recovery runs on Windows, even though ZFS is Linux/FreeBSD/whatever filesystem, not available on Windows. Therefore, you need to do one of the following:

  • bring drives (or clones of the drives) to a Windows machine,
  • install Windows on a spare hard drive, SSD, or even a big USB stick, and bring it to the Linux machine,
  • install Windows in a virtual machine and pass the drives through into that virtual machine.

No matter which method you choose, never initialize or format the drives from the pool if Windows prompts you to.

Selecting source drives

This is straightforward. ZFS pools normally consist of multiple physical drives, so you need many drives analyzed simultaneously in recovery. Select as many drives as possible, but do not select drives from multiple pools. All drives must be members of one ZFS pool. If you need to recover multiple pools, recover each pool in turn.

Selecting what to look for

ZFS can provide two types of storage

  • Regular filesystems, with files and directories. These are accessed directly if you run Linux or FreeBSD, or over the network share if you run a ZFS-based NAS.
  • Block-based storage, known as zvol. From ZFS side, it is a single large file. To the outside, it is presented as a block device, often over iSCSI.

You need to select which of these data types you want to recover along with disk selection. If in doubt, select both.

Progress stages and indications

There are four steps in the recovery:

  1. Disk scan. During this step, the entire disk set is scanned. All disks are scanned in parallel, so increasing number of disks does not result in proportional increase in scan time.
  2. Disk order analysis is when ZFS Recovery figures out RAID levels, which disk is at which position in the pool, and so on.
  3. Object set analysis. In ZFS, an object set is a table describing all files in the filesystem. Because ZFS is a copy-on-write filesystem, many previous versions of object set are scattered all over the disks. There may be millions of object sets, most of them partially overwritten and damaged.
    Object sets are processed in reverse transaction order. This means latest (most recent) object sets are processed first. You can stop the processing after some time, take a look at whatever is recovered, and if you are not satisfied with it, continue the analysis to hopefully recover more files or older files. However, pushing the "Stop analysis" button does not stop the process immediately. Instead, the object set currently being processed is processed till completion. This may take several minutes with large object sets.
  4. Checksum verification. Once all files are located, ZFS Recovery proceeds to verify the data to see if checksums are matching the data on disks. This is roughly equivalent to resilvering the pool, and takes a long time. You can cancel checksum verification. This is useful if you only need to recover some small number of files. In this case, there is no point in waiting while checksums are verified for the entire pool. Once the file list is shown, you can select these specific files and verify checksums for these files only.

Continue to Understanding output.

I have a low volume mailing list, for news and tips, which I send out once or twice a month.
Subscribe if you are interested.