Does a file "undelete" utility exist for the NetApp WAFL filesystem?

bepresseditor · ‎2010-05-18

As I understand it, where possible Data ONTap and WAFL do not reuse disk sectors when writing or rewritnig a file.

How about when deleting a file? Are the data blocks used for the file immedialy returned to the free pool, or kept for a while? I'm intresetd in an "undelete" or "unerase" uitility for WAFL. We recently had some log files that were supposed to be compressed, but were instead truncated, over nfs. Were WAFL a FAT or EXT3 or Hammer based filesystem, I'd know right where to go to recover at least most of the data.

On FC disks with BCS I understand there might not be extra space to link the blocks into a logical order. On SATA disks with ZCS is the "extra" space used to store any redundant metadata that might be useful in chaining blocks together for undelete? What are the undelete options with WAFL?

reena · ‎2010-05-18

I hope you are aware of the snapshots feature of the WAFL, so when you delete any file, those blocks get retained into a snapshots based on the schedules of the snapshots. You could retrieve your file back by copying it from the snapshots.

Reena

bepresseditor · ‎2010-05-18

In this case the hourly snapshot was long since gone, by the time the loss was discovered.

reena · ‎2010-05-18

Are there any snapmirror backups for this filesystems, that you can recover the file from ?

-Reena

bepresseditor · ‎2010-05-18

Had there been a snapmirror of this data, I'd not have mentioned this data.

The basic question sitll remains: are there any utilities can can harvest deleted WAFL filesysetm data, and present it for recovery. This is the traditional role of "undelete" utilites, and the opposite of disk_sanitization.

adamfox · ‎2010-05-18

There are no undelete utilities in ONTAP if the data is not in a snapshot.

eric_barlier · ‎2010-05-18

have you tried a file recovery utility that will run on NFS? WAFL is not really a filesystem. It provides inodes and such that are used by NFS, CIFS etc but does not contain

file information. dir. structure etc. thus is not really a file system as we know them. Theres a good blog about this you can google if you are interested.

Eric

adamfox · ‎2010-05-19

I'd be interested to see those blogs. The problem I see with an "NFS undelete" utility is that NFS is built on the idea of a file handle. The NFS server maps a path to a file handle. Once a file is deleted, that path can't map it to a valid file handle anymore.

But if someone has an idea about this, I'd be interested to read about it.

chriskranz · ‎2010-05-19

Dave Hitz wrote a pretty decent article on WAFL: http://blogs.netapp.com/dave/2008/12/is-wafl-a-files.html

There is a background task on the filer that runs periodically which scans all the data blocks. If they aren't pointed to by a snapshot or the active filesystem, they then get freed up. This could happen immediately, or several hours later. This helps the filer keep the filesystem (or the data on the disks) in pretty good order and efficient. However this does scupper any attempts at doing an undelete, as it would be incredibly difficult to guarantee any sort of this data.

However I do know that there is a company that has the ability to restore data beyond a snapshot! I believe this is something that they have to perform, rather than a tool you can use. But get in contact with them, and see what they have on offer. http://www.ontrackdatarecovery.co.uk/netapp-recovery/ (feel free to do some name dropping if you do contact them )

adamfox · ‎2010-05-19

Oh sure Ontrack can recover data, but you have to send them the drives. It's definitely not just a software tool.

-- Adam Fox

radek_kubka · ‎2010-05-20

Interesting stuff.

This is what they actually say:

"Data recovery for NetApp systems can be performed through Ontrack Data Recovery in-lab, remote and on-site services."

Aren't these guys simply leveraging aggregate snapshots (which are rumored to be a magic tool to e.g. undelete volumes)?

Regards,
Radek

adamfox · ‎2010-05-28

As I understand OnTrack, they are in the disk forensic business, not just leveraging aggregate snapshots which anyone could do.

But I'll be glad for someone from OnTrack to speak for themselves.

eric_barlier · ‎2010-05-19

Hi Adam,

heres the blog, get in with the program mate 😉

http://blogs.netapp.com/extensible_netapp/2008/10/why-wafl-is-not.html

I d be keen to hear if you agree with the blog.

Cheers,

Eric

Message was edited by: eric.barlier

adamfox · ‎2010-05-28

That looks like a link to about 5 other blogs posts. Is there something directly I can respond to with respect undelete that doesn't involve snapshots?

Sorry, only so many hours in a day.

saranraj456 · ‎2014-05-01

is there any way to recover the deleted volumes in ontap ,without having snapshots and other utility.

i heard a way to restore from maintenance mode , is it possible ?

Saran

careylawrence · ‎2014-06-18

I had faced the same problem last month then my friend suggest me to use third party software. Then i used it and got the satisfied results. One good thing about this software is that it is available as a Free to Try version. In Free version you are eligible to recover data and also see it but you are not authorized to save it, this is only the limitation of this software.