How to recover data from ZFS: ZVOLs, datasets, snapshots, and virtual disks
-
Author:
Vladimir Artiukh
-
Editor:
Oleg Afonin
Read about data recovery from the ZFS filesystem in TrueNAS 25.04.2.6. We will review how to analyze the pool structure and recover data from ZVOL, Dataset, Snapshot, as well as from virtual disks and virtual machines. We will cover common data loss scenarios, including array failures, failed system updates, hardware faults, and accidental deletion. All actions will be performed using Hetman RAID Recovery on Windows, while similar capabilities are also available on Linux and macOS.
- ZFS structure
- ZFS data recovery
- Virtual disk recovery
- Access to Snapshots in ZFS
- Deleted data recovery
- Conclusion
- Questions and answers
- Comments
The ZFS filesystem has long been considered one of the most reliable data storage solutions due to its high fault tolerance, built-in integrity checks, and extensive storage management features. In addition to ordinary file storage, ZFS supports important features such as ZVOL, Dataset, Snapshot and handling of virtual disks, which makes it popular on servers, NAS systems, and in virtualization environments.
However, even such a robust system is not immune to failures. Pool corruption, accidental deletion of a Dataset, loss of a Snapshot, errors when working with a ZVOL, or a virtual disk failure can lead to loss of access to important information. In these situations it is important to understand how to act correctly to avoid worsening the state of the storage and to maximize the chances of successful recovery.
In this article we will examine how to recover data from ZFS, including ZVOL, Dataset, Snapshot and virtual disks, which methods can be used to retrieve information, and which tools will help safely restore access to files after a failure.
How to recover data from BTRFS RAID 0, RAID 5 and RAID 6 created on Rockstor
ZFS structure
In the ZFS filesystem there are three main top-level object types: Dataset, ZVOL and Snapshot. Each has its own role and configuration options.
Dataset is the primary file container in a ZFS pool that functions as a separate filesystem for storing files and directories. You can mount it directly in the operating system and access it via FTP, NFS, iSCSI, SSH or SMB protocols. The main advantage of a Dataset is that you can configure its parameters independently without affecting other parts of the pool. When creating a dataset you set basic properties such as compression algorithm (LZ4, GZIP, ZSTD, LZJB, ZLE), access mode, case sensitivity, and synchronous write parameters. After creation most settings can be changed at any time without data loss, allowing each Dataset to be adapted to your specific tasks.
ZVOL represents a block device, i.e. a virtual disk that, unlike a Dataset, does not contain files directly. It provides block storage for creating filesystems or connecting as a disk to virtual machines. ZVOL operates at the block level and delivers more consistent performance compared to file-based images.
When creating a ZVOL you specify the logical size volsize and the block size volblocksize, which significantly affect performance. To optimize storage, enable compression to reduce volume and deduplication to eliminate duplicates. It is also important to enable the sparse mode, which allocates pool space only when data is actually written instead of reserving the entire capacity at creation time.
TrueNAS also allows creating virtual disks as files instead of ZVOLs. Such file images can be used via iSCSI, however they do not support the sparse mode and occupy the full amount of disk space immediately upon creation.
Snapshot is a point-in-time copy of a Dataset or ZVOL created using the copy-on-write mechanism, where new changes are written to other blocks while previous blocks remain unchanged. Thanks to this, a Snapshot consumes almost no additional space and allows restoring a previous state or individual files without affecting current data. After creation a Snapshot is read-only; it can be deleted or used for cloning. Management is performed via the visible and hide properties for visibility, as well as through snapshot tasks for automating replication and retention regarding transfer and retention period.
| Object type | Purpose | Key features | Where used |
|---|---|---|---|
| Dataset | Logical filesystem inside the ZFS pool | Supports compression, quotas, deduplication, separate access permissions | Storage of files and directories |
| ZVOL | Virtual block device | Operates like a regular disk, can be formatted with another filesystem | Virtual machines, iSCSI, databases |
| Snapshot | Snapshot of data state at a specific point in time | Created instantly, occupies minimal space until data changes | Backups, rollback, recovery |
ZFS data recovery
We will review the process of analyzing and recovering your data using the Hetman RAID Recovery application.
Hetman RAID Recovery can assist in critical situations when server hardware has failed, the TrueNAS operating system is malfunctioning due to updates or system errors, or drives in the server have failed. Regardless of the cause of data inaccessibility, the software enables extraction of information and recovery to a separate storage device.
Connecting disks
To start the recovery process you need to remove the disks that were part of the pool and connect them to a computer with Hetman RAID Recovery installed. This can be done directly via SATA ports on the motherboard or using external docking stations. If the hardware architecture of your workstation does not allow connecting all drives simultaneously, the application supports a combined approach.
In situations with limited free ports, an optimal solution is to create virtual images of some disks. You can connect some physical drives directly and use exact bit-by-bit copies mounted in the utility interface for others.
The application treats such images as full physical devices and automatically uses them to reconstruct the array structure. This approach ensures data safety since further analysis is performed on virtual copies.
After all pool components are physically connected or mounted as images, Hetman RAID Recovery will automatically read ZFS metadata and display the assembled array in the main window, enabling further scanning and file saving.
When detecting drives the program analyzes metadata and determines your RAID array configuration. The number of disks required for full data recovery depends on the configuration type you used:
- In a ZFS Stripe configuration there is no redundancy, so all disks are required. The absence or damage of even one drive makes full structure recovery impossible, and in such cases only partial data extraction from available disks is possible.
- RAIDZ1 tolerates a single disk failure. Therefore, recovery is possible if all drives except one faulty disk are connected. If two or more drives are missing, full structure recovery becomes impossible.
- RAIDZ2 allows loss of up to two disks. For correct pool reconstruction, the remaining healthy drives are sufficient, enabling data recovery even in double-failure scenarios.
- RAIDZ3 has the highest fault tolerance and allows loss of up to three disks. With the remaining healthy drives present, full data recovery is possible even in complex multiple-failure scenarios.
| ZFS type | Minimum number of disks | Allowed disk loss | Performance | Data protection level | RAID equivalent |
|---|---|---|---|---|---|
| Stripe | 2 | 0 | Very high | None | RAID 0 |
| RAIDZ1 | 3 | 1 | High | Medium | RAID 5 |
| RAIDZ2 | 4 | 2 | Medium | High | RAID 6 |
| RAIDZ3 | 5 | 3 | Lower | Very high | – |
Automatic pool reconstruction
Launch Hetman RAID Recovery and the program will automatically start scanning all connected devices. The utility reads ZFS service metadata, analyzes the configuration of virtual groups (vdev) and, based on the obtained data, reconstructs a correct model of your pool.
In the working window you will see all detected drives and their parameters. Select the desired pool from the list of reconstructed arrays and start the Fast Scan mode to quickly determine the data structure.
After scanning completes the recovered filesystem with the full directory and file hierarchy will be shown in the main window. You will be able to view all Datasets, folders, files, ZVOL, virtual disk files (LUN) and Snapshots. Expand folders to inspect contents and identify the objects to recover.
Mark the objects you want to recover and click Recovery.
On the next step specify a folder for saving the data by choosing a separate device with sufficient free space. This is critical to avoid overwriting the original data on the damaged disk. The program will display available space on the target device and the size of selected files for control.
Confirm the start of the saving process and specify the final save path inside the selected folder. Press Recovery again to begin copying your data to the chosen storage.
The application performs byte-by-byte copying with integrity verification and shows operation progress in real time. After copying completes press Finish.
All your recovered data is now available on the chosen device in its usual form and ready for further use without additional operations.
Virtual disk recovery
In situations where recovery is required due to accidental file deletion, partition formatting, or deletion of a virtual machine configuration while the ZVOL is preserved, Hetman RAID Recovery provides tools for deep analysis and data retrieval.
The program allows treating ZFS objects as full storage devices regardless of whether they are disk image files or a block device ZVOL. Thanks to support for a wide range of filesystems, including NTFS, ReFS, VMFS, Ext, XFS, BTRFS, FAT, ExFAT, APFS, HFS and HikvisionFS, you can successfully recover data from virtual environments of any complexity.
The recovery process begins by running a fast scan of the pool to locate the required ZVOL or virtual disk.
The found object can be mounted directly in the application interface or previously saved to the computer as an image file for further analysis. Direct mounting saves disk space since it does not require creating additional copies.
After mounting, the object appears in the device list as a regular disk ready for detailed inspection of its internal contents.
The choice of scanning mode for the mounted disk depends on the nature of the data loss. If files were simply deleted, use Fast Scan to quickly display the directory hierarchy. In more complex cases, such as formatting or changes to partition layout, it is recommended to use Full Scan for a thorough signature-based search.
After analysis completes you will be able to view existing and deleted files, verify their integrity via the preview window, and save required data to a safe healthy storage device.
Access to Snapshots in ZFS
Hetman RAID Recovery allows effective recovery of deleted or modified data from ZVOL objects and virtual disks using previously created Snapshots. This approach is critical when a full system rollback is impractical due to the risk of losing current changes made after snapshot creation, enabling preservation of the current system state while selectively restoring necessary data.
To start, run Fast Scan mode, after which a special Snapshot folder will appear in the pool hierarchy.
Snapshots inside are ordered by name and creation date, allowing quick identification of the desired recovery point. By selecting the appropriate Snapshot, you gain access to all objects that were captured at that time, including datasets and virtual disks. This allows simply copying required items without changing the current working pool structure.
If saving large ZVOL images to the local computer disk is not possible due to lack of time or free space, it is advisable to use the feature to mount objects directly in the application interface. This allows working with virtual disks and LUN images as regular storage devices without prior exporting them to a physical medium. Although processing speed in this mode may be somewhat lower, it significantly conserves resources and allows immediate deep file search inside guest filesystems such as NTFS, ext4 or XFS.
After the required object is mounted or selected inside the Snapshot, you can perform standard search and recovery actions. The program will display the virtual environment contents, allowing you to mark specific files and folders for saving.
Next, simply click Recovery and specify the path to a secure storage device.
This approach makes the recovery process transparent and convenient, providing flexibility when working with data in production environments where service continuity is a top priority.
Deleted data recovery
In cases where data was deleted directly from the pool and Snapshots are absent or have been overwritten, standard metadata analysis becomes ineffective. The specifics of the ZFS filesystem and the copy-on-write mechanism mean that after deletion the directory tree is often not preserved. However, the data itself remains in the pool blocks, which allows Hetman RAID Recovery to successfully locate and restore it even in the absence of placement table records.
Causes of such loss may include accidental deletion of datasets, ZVOL or virtual machines together with attached disks.
A critical scenario is initializing disks in foreign operating systems such as Windows or macOS, which can overwrite ZFS initial service information. In such scenarios the program performs a low-level analysis of the entire disk surface, identifying files and logical structures by their signatures.
To recover, select the reconstructed array and run Full scan. This process requires more time because the program works directly with data blocks, assembling scattered fragments into coherent objects. If deletion occurred inside a virtual machine, a two-stage analysis is applied: first the ZVOL is recovered as a block device, and then its internal filesystem is scanned to find the guest OS data.
After analysis completes, discovered objects typically appear as a single list at the pool root. To find the required ZVOL or file among thousands of found items, use the built-in search function. You can filter results by name, date, or file size. If the object’s name was not preserved in metadata, its volume is the primary indicator for identifying a virtual disk.
Found files can be recovered directly or mounted as virtual disks for further examination of their contents. Before final saving, it is recommended to use the preview function to verify data integrity.
After selecting the necessary items click Recovery and specify the path to a separate secure storage device with sufficient free space. The program will notify you upon completion of copying, after which all data will be ready for use.
Conclusion
Data recovery from the ZFS filesystem, including ZVOL, Dataset, Snapshot and virtual disks, is possible even after serious failures if actions are taken carefully and sequentially. Thanks to built-in integrity mechanisms, snapshots and flexible storage structure, ZFS significantly increases the chances of successfully retrieving information compared to many other filesystems.
Snapshots play a particularly important role in recovery, allowing restoration of a previous data state without complex reconstruction of the entire pool. For ZVOL and virtual disks an additional advantage is the ability to work with individual block devices, which simplifies analysis and copying of information. At the same time, metadata corruption or errors in the pool structure can greatly complicate the process and require specialized tools.
To increase the chances of successful recovery, it is important not to write to the problematic pool, not to create new datasets, and, if possible, to work only with copies of the drives. In complex cases the best solution may be to consult data recovery specialists.
Thus, even the complex ZFS architecture does not prevent recovery if its capabilities are used correctly and a safe approach is followed when working with a damaged storage.
