Hardware and RAID configuration:

The customer has a FreeNAS 9.3 system with 3x3TB hard drives in RAIDZ1 configuration.

Problem:

A share holding 2TB of data was deleted from the system. The last backup of the share was 2 years old.
The customer needed to recover digital photos (CR2s, JPGs, TIFs, ...) created or modified in the last 2 years. File names and folder structure were not important.

Solution:

We came up with the following procedure to recover the deleted data:

• Scanned the drives for FSO (File System Object) dnodes.
• Filtered out file system dnodes, intermediate dnodes (ZFS uses Copy-On-Write. As a result, multiple dnodes are created when a file is created or modified), and files with modified date older than 2 years ago.
• Used the info in the dnode to read the header of the files.
• Used the header to filter our irrelevant files and recovered only digital photos.

Result:

We were able to recover 95% of digital image files for the customer.