Hello everybody!
Watch this video to learn about top tools to recover data from ZFS drives.
ZFS is a revolutionary file system that follows an absolutely different approach to administration
of file systems while offering new features and advantages that no other file system can
provide at the moment.
ZFS is reliable, scalable and easy to manage.
ZFS moves away from conventional file system principles by dropping the concept of volumes.
Instead, ZFS offers more complicated storage pools that consist of one or more data media.
Such media can be added to the pool or removed from it if and when necessary.
File systems are then dynamically expanded or reduced without having to format specific
media.
ZFS ensures a format of disks that is constantly harmonized and coordinated.
Such pattern guarantees that disk data is not overwritten for quite a long time, and
all updates to the file system are made at the lowest level.
However, just as any other file system, ZFS is not perfect, and it sometimes suffers from
crashes and data loss.
In today’s video, we are going to test top tools able to recover such data from this
file system.
ZFS structure For starters, let’s explore the ZFS structure.
It is divided into 7 main elements: SPA (storage pool allocator), DSL (data and snapshot layer),
DMU (data management unit), ZAP (ZFS attribute processor), ZPL (ZFS POSIX layer), ZIL (ZFS
intent log) and ZVOL (ZFS volume).
ZFS pools are built as combinations of virtual devices of two types: physical and logical
virtual devices.
Physical vdevs are writable block devices (for example, hard disks), while logical vdevs
are combined groups of physical disks.
All vdevs create a tree, the leaves of which are represented by physical devices.
All pools have a special logical vdev, which is the root of such tree.
All branches of the root vdev are known as top-level virtual devices.
Every physical virtual device contains a structure of 256 KB known as vdev label.
It contains information about this device and al virtual devices with which it shares
a top-level vdev.
The label comprises four parts: 8 KB of blank space, 8 KB of boot header, 112 KB of name
/ value pairs and 128 KB of space occupied by 1 KB uberblock structures.
Unlike other file systems, ZFS does not have such a thing as Superblock, but it has a Vdev
Label instead.
In the structure, there are four of them, each occupying 256 KB of space.
This is where they are located: label zero and label one - at the beginning of the disk.
The second and the third are positioned similarly, but at the end of the disk.
Inside vdev labels, there are uberblocks that contain links to data.
If one of vdev labels is erased, a data recovery tool may have some difficulty in searching
for information on the disk.
In today’s video, we’re going to show you how to recover deleted data from a ZFS
drive, and how to recover data if a part of the file system structure is gone.
How to recover data from a ZFS drive In a Linux operating system, I created a ZFS
pool, wrote some data to the disk - a few folders containing photos, videos, and documents,
and then removed some of them.
For our benchmarking assessment, we have selected several popular data recovery tools - Hetman
RAID Recovery, Reclaime, UFS Explorer, Diskdrill, Wondershare Recoverit and R-Saver.
All right, let’s get down to testing.
Hetman RAID Recovery Let’s connect the ZFS disk.
Windows can’t recognize this file system, and when the drive is connected, the operating
system suggests formatting it so that the disk can be used.
However, in fact there is no need to format anything - start Hetman RAID Recovery and
scan the disk.
You can see that the program can recognize the disk, detect its file system and display
its name and size properly.
To view the contents and find the deleted files, right-click on the disk and choose
“Open.”
In this case, a “Fast scan” should be enough.
This type of analysis will scan the disk quickly and display the results - you can see them
on the screen.
In this scenario, the tool has no difficulty in finding the files deleted in such a way,
and it displays them marked with a red cross.
Full analysis and signature search are not required for this case.
Considering they take much longer to complete, it saved us quite a lot of time.
The contents of all files can be checked with the preview feature, and you can search files
by name, which helps you find the necessary data even quicker.
Now, all the files have been recovered.
What is more, the disk structure is retained, so all files and folders can be found where
they used to be, and it makes searching for lost data extremely easy.
In a very short time and with little effort, the program was able to find and recover the
data previously removed from a ZFS disk.
UFS Explorer Let’s try another candidate, UFS Explorer.
It shows the disk name, capacity and an ZFS partition below.
When you view the contents of this directory, only the files which are still on the disk
are displayed, but you can’t see the ones that have been deleted.
Let’s run a Quick scan.
The result is similar.
Now let’s start searching for lost files.
Uncheck unnecessary options - if you don’t do that, the search will take longer.
This is a disadvantage for novice users, who are unlikely to notice and disable all those
options.
Searching for lost files on a relatively small 15 GB drive took over 15 minutes.
Scanning a disk of larger capacity will certainly require much more time.
As a result, the program has found the deleted data - it is marked with a different color,
but only photos can be previewed.
This is another drawback, because we cannot understand if they could be recovered in the
end, and if they are going to be damaged.
Also, it’s very inconvenient to know so little about your chances of recovery before
you actually buy the tool.
Reclaime Pro Let’s try another candidate, Reclaime.
The initial screen doesn’t show the disks; at first, you need to set up a proxy server,
then skip the registration window, and then configure disk scan options.
After that, the program will start analyzing connected hard disks and then display their
list on the screen, which also takes some time.
The program reads service information, identifies the file system, names and so on.
When the process is over, we can see the list of recognized devices.
Here is the test disk, and when we expand it, you can see a ZFS partition.
Select it and start the scan.
In the next window, you can choose the scan type: we leave the recommended option as it
is, uncheck unnecessary file system options.
The program has identified the file system, but nevertheless, all file system variants
are activated.
If all variants are selected, the scan will take much longer, so that why we choose to
uncheck the unnecessary ones, and then click “Start.”
As a result, the program has found some files; only the contents of RAW folder can be previewed,
and other files are not displayed.
The deleted files are not showing either, file names are not preserved, the dis structure
is damaged, and the program couldn’t find any documents.
Most likely, a deeper scan is required to find the deleted files, so let’s click “Resume”
to start.
The deep scan of a 15 GB drive took over 30 minutes; when scanning, this program uses
a signature search - you can tell it by how the files are sorted.
When dealing with a drive of big capacity, the process can be really long.
As a result, documents are not available for preview, and some of the photos we have found
are damaged.
The same happened to video files: some of them damaged and can’t be played properly.
The structure and file names are lost, many files are damaged, and will not be recovered
completely.
Disk Drill The next one on the list is Disk Drill.
The program can see the storage device, its name and capacity, but the file system is
not recognized.
Quick Scan is not available for this disk as the program was unable to identify its
file system, so all you can use is a deeper scan.
Click “Search for lost data.”
With such scan, the program also looks for files by their signatures; in this case, file
names and disk structure are not preserved, and the scan takes a pretty long time to complete
- it turned out to be longer than with other tools.
As file names are not preserved, it’s difficult to understand which of them were removed,
and it’s also hard to tell how effective the final result should be.
In the preview, we can see that some photos and videos are damaged.
The documents can’t be viewed.
The program did manage to find some of the deleted data, but it lacks the quick scan
feature, deleted files are not marked in any way, all files are sorted into folders by
type, and it is difficult to find the ones you need.
Also, file search takes quite a long time.
Taking into account the results demonstrated by its rivals, it’s better to choose a different
tool.
Wondershare Recoverit One more program to test is Wondershare Recoverit.
The program can see the test disk, but it can’t identify its name and file system.
Also, you can’t choose scan type for this file system.
When you try to open the disk, the full scan starts immediately.
While scanning, this program uses signature search.
Just as with the previous recovery tools, files are sorted by type.
When the scan is over, we can see that the program managed to find the files and even
partially rebuild the disk structure.
The folders with preserved names don’t contain any deleted files.
Other files are sorted by type but their names are missing, so it is difficult to evaluate
the scan result.
Some photos are damaged, video previews are limited to 10 seconds, so it is hard to tell
if the program can recover such files in full.
In documents, you can only view their first page, and the rest should be available only
after you purchase the full version of this tool.
In the end, we can say that this program does support ZFS, but some files get damaged, and
it is difficult to evaluate the result properly as we can’t see which of the files are the
ones that have been deleted before the scan.
R-Saver The next one on the list is R-Saver.
It can see the disk, but the format is unknown for this tool, as it can’t identify the
file system.
We couldn’t open the disk without scanning, so the deep scan begins.
In the end, the program found some files; it shows deleted photos in the root folder,
and their contents can be previewed.
Documents are not displayed; the videos that remained on the disk and the videos that we
have removed could not be found; and there is not a single folder with photos.
Videos are not displayed in preview.
However, the disk structure is preserved, but one folder is still missing.
That’s a good result for a free tool, but you shouldn’t rely on it too much, as most
of the information was not recovered.
Erasing the main Vdev label For the second test, I’m going to erase
the main Vdev Label.
Then I’ll save the result to a disk image.
It will be used in all recovery operations.
All further tests will only involve the programs that managed to recover all data and preserve
the disk structure - and they are Hetman RAID Recovery and UFS Explorer.
As to the others, we already know, with more or less certainty, what results should be
expected.
Hetman RAID Recovery All right, let’s start Hetman RAID Recovery.
As you can see, even in this case the program can identify the disk, its name and file system.
Even the “Fast scan” option is available.
Finally, it shows the same result as in the previous test, without erasing elements.
All photos, documents and videos are displayed, and the deleted ones are marked accordingly,
with their names and disk structure preserved, and not a single file is damaged.
Their contents can be viewed without any limitations, and it means you can be 100% sure that these
files will be recovered in full.
UFS Explorer Let’s try another candidate, UFS Explorer.
There is no quick scan option either, so let’s look for deleted data.
The result is also similar to the previous test.
The program has found the deleted files and marked them with a different color.
However, previews are only available for photos.
This is a serious disadvantage, as we don’t know if the program can recover them in full,
and to check it, all you can do is to buy the full version.
That’s why we can’t be sure if the recovery works as expected.
This is another drawback, because we cannot understand if they could be recovered in the
end, and if they are going to be damaged.
Also, it’s very inconvenient to know so little about your chances of recovery before
you actually buy the tool.
If we have a closer look at the photos, we can see that some photos are not displayed.
036.jpg
Conclusion Now let’s draw the bottom line.
From the entire list of tested recovery tools, only two programs managed to find data with
file names and disk structure preserved - Hetman RAID Recovery and UFS Explorer.
However, UFS Explorer fails to display previews for documents and videos.
Without saving the files, it is difficult to estimate if all of them can be recovered
in full.
And this is very inconvenient, because you have to buy the full version of the program
to be able to save files, and in the end, the files could be damaged, and some documents
or videos will never open.
On the other hand, Hetman Partition Recovery displays all files in the preview window,
and you can evaluate the program’s effectiveness before actually paying for the full version
license.
The recovery process is very simple because of the convenient and intuitive interface
that is easy to navigate even for beginners.
This program lets you retain the folder structure and file names which makes it easier to search
for certain data and saves your time.
The algorithm used in our product lets you recover data even if the entire structure
of the file system is erased, and if the disk has at least some data left, Hetman Partition
Recovery can restore it and display it to you due to using signature analysis.
In addition, this tool supports recovery from RAIDs of various levels including RAID-Z,
and works with most file systems.
It can also help you rebuild a damaged disk array and extract the lost information.
That is all for now!
Hopefully, this video was useful.
Remember to click the Like button and subscribe to our channel.
Leave comments to ask questions.
Thank you for watching.
Good luck.