As I understand it, where possible Data ONTap and WAFL do not reuse disk sectors when writing or rewritnig a file.
How about when deleting a file? Are the data blocks used for the file immedialy returned to the free pool, or kept for a while? I'm intresetd in an "undelete" or "unerase" uitility for WAFL. We recently had some log files that were supposed to be compressed, but were instead truncated, over nfs. Were WAFL a FAT or EXT3 or Hammer based filesystem, I'd know right where to go to recover at least most of the data.
On FC disks with BCS I understand there might not be extra space to link the blocks into a logical order. On SATA disks with ZCS is the "extra" space used to store any redundant metadata that might be useful in chaining blocks together for undelete? What are the undelete options with WAFL?
I hope you are aware of the snapshots feature of the WAFL, so when you delete any file, those blocks get retained into a snapshots based on the schedules of the snapshots. You could retrieve your file back by copying it from the snapshots.
Had there been a snapmirror of this data, I'd not have mentioned this data.
The basic question sitll remains: are there any utilities can can harvest deleted WAFL filesysetm data, and present it for recovery. This is the traditional role of "undelete" utilites, and the opposite of disk_sanitization.
I'd be interested to see those blogs. The problem I see with an "NFS undelete" utility is that NFS is built on the idea of a file handle. The NFS server maps a path to a file handle. Once a file is deleted, that path can't map it to a valid file handle anymore.
But if someone has an idea about this, I'd be interested to read about it.
There is a background task on the filer that runs periodically which scans all the data blocks. If they aren't pointed to by a snapshot or the active filesystem, they then get freed up. This could happen immediately, or several hours later. This helps the filer keep the filesystem (or the data on the disks) in pretty good order and efficient. However this does scupper any attempts at doing an undelete, as it would be incredibly difficult to guarantee any sort of this data.
However I do know that there is a company that has the ability to restore data beyond a snapshot! I believe this is something that they have to perform, rather than a tool you can use. But get in contact with them, and see what they have on offer. http://www.ontrackdatarecovery.co.uk/netapp-recovery/ (feel free to do some name dropping if you do contact them )
I had faced the same problem last month then my friend suggest me to use third party software. Then i used it and got the satisfied results. One good thing about this software is that it is available as a Free to Try version. In Free version you are eligible to recover data and also see it but you are not authorized to save it, this is only the limitation of this software.