2010-05-18 10:17 AM
As I understand it, where possible Data ONTap and WAFL do not reuse disk sectors when writing or rewritnig a file.
How about when deleting a file? Are the data blocks used for the file immedialy returned to the free pool, or kept for a while? I'm intresetd in an "undelete" or "unerase" uitility for WAFL. We recently had some log files that were supposed to be compressed, but were instead truncated, over nfs. Were WAFL a FAT or EXT3 or Hammer based filesystem, I'd know right where to go to recover at least most of the data.
On FC disks with BCS I understand there might not be extra space to link the blocks into a logical order. On SATA disks with ZCS is the "extra" space used to store any redundant metadata that might be useful in chaining blocks together for undelete? What are the undelete options with WAFL?
2010-05-18 10:30 AM
I hope you are aware of the snapshots feature of the WAFL, so when you delete any file, those blocks get retained into a snapshots based on the schedules of the snapshots. You could retrieve your file back by copying it from the snapshots.
2010-05-18 12:40 PM
Had there been a snapmirror of this data, I'd not have mentioned this data.
The basic question sitll remains: are there any utilities can can harvest deleted WAFL filesysetm data, and present it for recovery. This is the traditional role of "undelete" utilites, and the opposite of disk_sanitization.
2010-05-18 10:30 PM
have you tried a file recovery utility that will run on NFS? WAFL is not really a filesystem. It provides inodes and such that are used by NFS, CIFS etc but does not contain
file information. dir. structure etc. thus is not really a file system as we know them. Theres a good blog about this you can google if you are interested.
2010-05-19 09:31 AM
I'd be interested to see those blogs. The problem I see with an "NFS undelete" utility is that NFS is built on the idea of a file handle. The NFS server maps a path to a file handle. Once a file is deleted, that path can't map it to a valid file handle anymore.
But if someone has an idea about this, I'd be interested to read about it.
2010-05-19 01:33 PM
Dave Hitz wrote a pretty decent article on WAFL: http://blogs.netapp.com/dave/2008/12/is-wafl-a-files.html
There is a background task on the filer that runs periodically which scans all the data blocks. If they aren't pointed to by a snapshot or the active filesystem, they then get freed up. This could happen immediately, or several hours later. This helps the filer keep the filesystem (or the data on the disks) in pretty good order and efficient. However this does scupper any attempts at doing an undelete, as it would be incredibly difficult to guarantee any sort of this data.
However I do know that there is a company that has the ability to restore data beyond a snapshot! I believe this is something that they have to perform, rather than a tool you can use. But get in contact with them, and see what they have on offer. http://www.ontrackdatarecovery.co.uk/netapp-recovery/ (feel free to do some name dropping if you do contact them )