How to recover data from NetApp ONTAP storages
NetApp ONTAP storage solutions are quite specific due to their unique architecture, which combines WAFL (Write Anywhere File Layout) with proprietary RAID implementations optimized for this file system. Standard data recovery tools are normally not applicable to these systems, requiring a specialized approach and advanced software like UFS Explorer Technician. The utility can handle NetApp-specific technologies, enabling proper storage reconstruction and data recovery in some scenarios. This article outlines the internal layout of NetApp ONTAP systems and explains how to approach their recovery using UFS Explorer Technician.
NetApp ONTAP support in UFS Explorer
UFS Explorer Technician offers limited support for data recovery from NetApp storages running the ONTAP operating system and WAFL file system. This refers to the fact that the software can only work with certain scenarios and technologies implemented within WAFL.
The software supports the following technologies:
WAFL file system on-disk format layout – version 2, 3 and 4;
both classic and FLEX volumes;
RAID-P and RAID-DP (reconstruction with all drives or one drive missing);
data compression and deduplication (experimental support)
The software does NOT support:
WAFL version 1 and any layout newer than version 4;
RAID-DP with two drives missing.
Although WAFL can be scanned in search of deleted volumes and files, this function is currently not implemented. This means that the data recovery scenarios that could be handled by the software are limited to:
RAID failures;
OS/controller failures;
loss of access to the system.
System description
NetApp Data ONTAP storage consists of one or more disk enclosures populated with SAS or SATA/FATA drives. Most modern systems use SAS drives formatted with 520-byte sectors.
The drives are grouped into RAID sets called "aggregates". Typically, the most common configuration is RAID-DP (Dual-Parity). Each aggregate contains one "classic" WAFL volume (usually unused) and one or more FLEX volumes, each representing an "isolated" file system. These FLEX volumes share disk space of an aggregate.
On-disk data layout
In most cases, data is stored on SAS drives with 520-byte sector sizes. Unlike the majority of similar systems, where 512 bytes contain data and 8 bytes contain metadata, NetApp uses clusters of 8 sectors: 520 bytes of the first 7 sectors and 456 bytes of the last sector.
Thus, a special approach is required for correct data transformation (see below).
The drives are then grouped into RAID sets, with dedicated parity components:
Each drive contains metadata at the beginning and end to identify its position in the RAID configuration. And unlike in traditional RAID, the data is not rotated at the RAID level: the rotation between the drives is managed by WAFL instead.
Volume reconstruction in UFS Explorer
It is required to create complete plain (flat) disk images of the drives that include every byte of the data stored on them. In other words, if the system uses SAS drives with 520-byte sectors, all 520 bytes from each sector must be saved to the image.
After that, you need to open all available disk images in UFS Explorer Technician. In case the original drives (the disk images were made of) are SAS with 520-byte sectors, sector size transformation (from 4160 to 4096 bytes) must be applied. This way, the 64 bytes of metadata in each 8th sector will be skipped.
After the transformation is applied, the software should be able to detect (by a superblock) the correct offset of the data and the size of the data area on the disk.
In the case of RAID-P, the first drive contains parity, and all other drives contain data in the form of SPAN. So, you need to build a spanned volume using the data partitions of every drive with the data, placing them in the correct order and skipping the component with parity.
In the case of RAID-DP, the layout is mostly the same. The first drive contains diagonal parity, the second one contains straight parity and then they are followed by "data" drives. This means the two first ("parity") drives must be skipped.
If one of the RAID-P or DP drives is missing, it’s possible to reconstruct the array with the help of "Parity calculator": use the data from the existing drives, plus the "straight" parity information (the first drives from RAID-P and the second one from RAID-DP).
Once the spanned volume is assembled, the software should be able to recognize the WAFL file system automatically.
Last update: Feb 20, 2025