# PostgreSQL Data Recovery

PostgreSQL stores everything in a data directory: heap files in base/, write-ahead logs in pg_wal/, and cluster metadata in global/pg_control. When the underlying drive fails, pg_resetwal and pg_dump cannot access these files. We image the failed drive using PC-3000, extract the cluster directory, reconstruct pg_control and missing WAL segments, and bring the database online. PostgreSQL 9.x through 18. No data, no fee.

[Start a Recovery](/contact)[All Database Services](/services/database-recovery)

Author

![Louis Rossmann](/_next/image?url=%2Fimages%2Flouis-rossmann-portrait.jpg&w=3840&q=75)

Written by

[Louis Rossmann](/louis-rossmann)Founder & Chief Technician

Updated March 2026

No Data = No Charge

WAL + pg_control Repair

PC-3000 + Hex Recovery

Nationwide Mail-In

## Can you recover a PostgreSQL database?

Yes. Physical media failures (corrupt storage, a failed RAID member, a failed SAS or SATA drive) are recoverable: we image the drive with PC-3000 first, then reconstruct pg_control & missing WAL segments at the SQL layer. Logical-only failures (corrupt heap pages, transaction-log inconsistency) skip the hardware step & go straight to cluster repair. No data, no fee.

Overview

PostgreSQL Stores Data

## How PostgreSQL Stores Data on Disk

Unlike SQL Server or Oracle, PostgreSQL does not use a single monolithic database file. The cluster is a directory tree managed by the postmaster process. Understanding this layout is the first step in recovery.

- **base/** contains one subdirectory per database, named by OID. Each table and index is stored as one or more 1GB segment files (e.g., base/16384/24576, base/16384/24576.1).
- **pg_wal/** (pg_xlog in versions before 10) holds 16MB write-ahead log segment files. Each segment is named by timeline and LSN position (e.g., 000000010000000000000042). PostgreSQL replays these segments during crash recovery to bring the cluster to a consistent state.
- **global/pg_control** is an 8KB file containing the cluster's checkpoint location, database system identifier, catalog version, WAL segment size, and timeline ID. If this file is missing or corrupted, PostgreSQL will not start.
- **pg_tblspc/** contains symlinks to tablespace directories on other filesystems or drives. Tablespace-resident tables will be missing from the recovery if the target drive is not also recovered.
- **pg_xact/** (pg_clog before version 10) stores transaction commit status bitmaps. Each page tracks 32,768 transaction IDs. Corruption here causes PostgreSQL to report transactions as "in progress" indefinitely, making affected rows invisible to queries.

Common Failure Scenarios

## Common Failure Scenarios

FailureSymptomsRecovery ApproachCorrupted pg_controlPostgreSQL refuses to start. Error: "could not read file 'global/pg_control'" or checksum mismatch on pg_control.Reconstruct pg_control from WAL segment headers. Match checkpoint LSN, timeline, and system identifier from the recovered pg_wal/ contents.Missing WAL segmentsPostgreSQL starts but panics during recovery: "requested WAL segment has already been removed." The cluster cannot reach a consistent checkpoint.Recover WAL segments from the drive image. If segments are unrecoverable, force the cluster to a prior consistent checkpoint and accept data loss from the gap.base/ directory corruptionSpecific tables return I/O errors. pg_dump fails on individual tables. The cluster starts but queries against affected tables produce "could not read block" errors.Image the drive to recover the damaged heap file segments. Parse the page headers (each 8KB page has a PageHeaderData struct) and extract intact tuples. Export recoverable rows via COPY.pg_xact / CLOG corruptionRows disappear from query results despite existing in the heap files. VACUUM reports errors. Transaction visibility checks fail because commit status is unreadable.Reconstruct the CLOG pages from WAL records. Alternatively, mark all ambiguous transaction IDs as committed and let the application layer validate data integrity.Failed pg_upgradepg_upgrade crashed mid-migration. The old cluster's data directory was partially modified. The new cluster is incomplete. Neither version of PostgreSQL will start.Recover the pre-upgrade data directory from the drive image. If the old cluster files are intact, revert to the original version. If partially overwritten, extract tables from whichever cluster has the most complete heap files.

Pg_resetwal Is A Last

## Why pg_resetwal Is a Last Resort

pg_resetwal (pg_resetxlog before version 10) forces PostgreSQL to start by writing a new pg_control file and discarding all existing WAL history. The PostgreSQL documentation warns that after running this command, the database should be dumped and reloaded immediately, and that data may be silently lost.

The mechanism behind the data loss: pg_resetwal creates a new checkpoint record and advances the transaction counter past any in-flight transactions. Committed transactions that were recorded in WAL but not yet flushed to the heap files are permanently lost. The database will start, but the data on disk may not match what was committed by the application.

When the corruption originates from a physical drive failure, the situation is worse. pg_resetwal operates on whatever data the operating system can read from the degraded drive. Sectors with read errors are silently skipped or filled with zeros. Running pg_resetwal on this partial data locks in the loss. Imaging the drive with PC-3000 using adaptive read parameters first recovers more sectors, producing a more complete data directory to work with.

**Before running pg_resetwal:** Power down the server. Do not run `pg_resetwal -f` on the original data directory. Each modification reduces the data available for recovery. Contact us for a free evaluation of the drive's physical condition first.

Our PostgreSQL Recovery Workflow

## Our PostgreSQL Recovery Workflow

1

### Drive assessment and forensic imaging

Evaluate the drive using PC-3000 diagnostics. If the drive has mechanical damage (clicking, not spinning, scored platters), we perform a head swap in the 0.02µm ULPA-filtered clean bench before imaging. The target is a complete sector-level clone on healthy media.

2

### File system reconstruction and cluster extraction

Mount the cloned image and locate the PostgreSQL data directory. Linux ext4/XFS metadata is parsed to recover the directory tree. If the file system is too damaged for standard mounting, we carve the data directory structure from raw sectors using inode and directory entry analysis.

3

### pg_control and WAL reconstruction

If pg_control is missing or corrupted, we reconstruct it by scanning the recovered WAL segments for checkpoint records. The system identifier, checkpoint LSN, timeline ID, and catalog version are extracted from WAL headers and cross-referenced against the pg_wal/ directory naming convention.

4

### Heap file validation and tuple extraction

Scan every heap file in base/ for valid 8KB pages. Each page contains a PageHeaderData struct with LSN, checksum (if data checksums are enabled), and tuple offset pointers. We validate page headers, extract intact tuples, and flag pages with unrecoverable damage. TOAST relations are cross-referenced against their parent tables to reassemble oversized values.

5

### Cluster startup and data export

Start the recovered cluster in a sandboxed PostgreSQL instance matching the original version. Run pg_catalog integrity checks. Export all recoverable data via pg_dump or per-table COPY TO commands. Deliver the output as a SQL dump file, custom-format archive, or a running cluster on a fresh drive.

Toast Table Recovery

## TOAST Table Recovery

PostgreSQL's TOAST (The Oversized-Attribute Storage Technique) mechanism automatically compresses and splits column values that exceed approximately 2KB. The overflow data is stored in a separate TOAST table (pg_toast.pg_toast_NNNNN) with chunk_id and chunk_seq columns linking back to the parent row.

TOAST tables are the most fragile part of a PostgreSQL cluster during drive failures. Because TOAST data is distributed across separate heap files from the parent table, a partial drive failure can leave the main table intact while destroying the TOAST relation. Queries against affected rows return: "ERROR: missing chunk number 0 for toast value NNNNN in pg_toast.pg_toast_XXXXX."

Standard recovery tools (pg_dump, pg_restore) cannot handle this failure mode because they attempt to read the TOAST data through the normal SQL interface, which throws an error. We bypass the SQL layer and read the TOAST heap files directly from the recovered image, extracting valid chunks and mapping them back to parent rows by OID. Columns with unrecoverable TOAST chunks are flagged in the export rather than causing the entire table dump to fail.

Multi-Drive Tablespaces

## Tablespace and Multi-Drive Clusters

Production PostgreSQL deployments often place tablespaces on separate drives or partitions for I/O distribution. The pg_tblspc/ directory contains symbolic links pointing to each tablespace's physical location. When any of these drives fail, tables in that tablespace become inaccessible while the rest of the cluster may function normally.

For multi-drive recovery, send all drives that were part of the PostgreSQL server. Label each drive with its original mount point (e.g., /var/lib/postgresql/data, /mnt/fast-ssd/pg_tblspc). We image each drive independently and reconstruct the symlink relationships from the pg_tblspc/ entries and the tablespace OID directories.

If the cluster ran on a [RAID array](/services/raid-data-recovery), each member drive is imaged and the array is reassembled virtually before extracting the PostgreSQL data directory.

Postgis And Extension Data

## PostGIS and Extension Data Recovery

PostGIS stores geometry and geography values as binary data within standard PostgreSQL heap pages. Point, polygon, linestring, and raster columns follow the same on-disk format as any bytea column. The spatial data itself does not require special handling during recovery.

Spatial indexes (GiST, SP-GiST, BRIN) are stored in separate relation files and are fully rebuildable. After the cluster starts, running REINDEX on spatial indexes restores query performance without any data loss. If the extension shared library files (postgis.so, postgis_raster.so) are missing from the recovered image, we install the matching PostGIS version in the sandboxed recovery environment.

Other extensions with on-disk state (pg_trgm indexes, hstore columns, JSONB GIN indexes) follow the same pattern: the data is in heap pages, the indexes are rebuildable, and the extension libraries are installed in the recovery environment to match the original cluster configuration.

More Failure Modes

## Additional PostgreSQL Failure Modes

These four failures each raise a distinct error string but share one recovery principle: image the drive first, then repair at the SQL layer. WAL replay halts on a bad checksum, the catalog loses a relation mapping, filesystem repair severs tablespace symlinks, or a data page checksum flags a storage fault.

### WAL corruption during REDO

A missing WAL segment & a corrupt WAL record fail differently. When a segment is absent, PostgreSQL reports that a requested segment was already removed. When the segment is present but a record fails its CRC32C check, replay stops at the first bad record to preserve consistency, reporting `incorrect resource manager data checksum in record at X/Y` or `invalid record length`.

Torn writes from a power-loss event or failing media can produce a bad record even with `full_page_writes` enabled. Running `pg_resetwal` here destroys WAL history & hides how far replay could safely reach. We image the drive, recover the longest span of undamaged WAL segments, & stop replay at the last-good LSN so transactions committed up to that point are preserved rather than discarded.

### System catalog corruption (pg_catalog)

A heap file on disk is a stream of 8KB pages with no embedded table name, column list, or data types. That layout lives in the system catalog. When `pg_class`, `pg_attribute`, or the relation-mapping file is damaged, PostgreSQL cannot map a stored relfilenode back to its table OID & reports `catalog is missing 1 attribute(s) for relid NNNN`.

pg_classOne row per table & index. Holds the relfilenode that names the on-disk file.

pg_attributeOne row per column. Defines the row & column layout a raw heap file cannot describe on its own.

pg_filenode.mapThe relmapper file that ties the bootstrap catalogs to their physical files.

We reconstruct the relfilenode-to-OID mapping by parsing the recovered storage directly, then re-associate each heap file with its table definition so the rows read back into a working schema.

### Filesystem errors and orphaned tablespaces

This is filesystem repair damage, not a failed tablespace drive. After a crash, `fsck` or a repair pass on a [ZFS-hosted cluster](/services/zfs-data-recovery) can sever the symlinks in `pg_tblspc/` or move a tablespace's OID directory into `lost+found`. The data survives, but PostgreSQL reports `could not open file` or that the tablespace does not exist.

We locate the orphaned tablespace OID directories in the recovered image & rebuild the `pg_tblspc/` symlink relationships so each tablespace resolves back to its original path.

### Data-page checksum corruption vs XID wraparound

These two errors read alike in a panic & call for opposite responses. One is a storage problem; the other is a maintenance problem. Table bloat from dead MVCC tuples does not corrupt data pages, so a bloated database is not a damaged one.

SignalLayerMeaning`invalid page in block N of relation ...`Physical storageWith data checksums enabled, a bad 8KB page points at an underlying storage fault. Forcing past it with `ignore_checksum_failure` risks propagating bad data.`database is not accepting commands to avoid wraparound data loss`LogicalA protective shutdown from neglected autovacuum exhausting the 32-bit transaction-ID space. No data page is corrupt.

A page-checksum error points at the physical media, so we treat it as a [storage fault](/services/ssd-data-recovery) to image before any SQL-layer work, not a flag to override.

Pricing

## Pricing

PostgreSQL recovery pricing is based on the physical condition of the drive. Cluster repair (pg_control reconstruction, WAL rebuild, TOAST recovery, heap file extraction) is included at no additional charge. For [RAID arrays](/services/raid-data-recovery), each member drive is priced separately.

- 01Low complexity

### Simple Copy

Your drive works, you just need the data moved off itFunctional drive; data transfer to new mediaRush available: +$100$1003-5 business days
- 02Low complexity

### File System Recovery

Your drive isn't recognized by your computer, but it's not making unusual soundsFile system corruption. Accessible with professional recovery software but not by the OSStarting price; final depends on complexityFrom $2502-4 weeks
- 03Medium complexity

### Firmware Repair

Your drive is completely inaccessible. It may be detected but shows the wrong size or won't respondFirmware corruption: ROM, modules, or translator tables corrupted; requires PC-3000 terminal accessCMR drive: $600. SMR drive: $900.$600–$9003-6 weeks
- 04High complexity

### Head Swap

Bench diagnosis found the read/write heads have to be replaced. Clicking can also come from firmware, the preamp, or the spindleHead stack assembly failure. Transplanting heads from a matching donor drive on a clean bench50% deposit required. CMR: $1,200-$1,500 + donor. SMR: $1,500 + donor.50% deposit required$1,200–$1,5004-8 weeks
- 05High complexity

### Surface / Platter Damage

Your drive was dropped, has visible damage, or a head crash scraped the plattersPlatter scoring or contamination. Requires platter cleaning and head swap50% deposit required. Donor parts are consumed in the repair. Most difficult recovery type.50% deposit required$2,0004-8 weeks

### Hardware Repair vs. Software Locks

Our "no data, no fee" policy applies to hardware recovery. We do not bill for unsuccessful physical repairs. If we replace a hard drive read/write head assembly or repair a liquid-damaged logic board to a bootable state, the hardware repair is complete and standard rates apply. If data remains inaccessible due to user-configured software locks, a forgotten passcode, or a remote wipe command, the physical repair is still billable. We cannot bypass user encryption or activation locks.

**No data, no fee.** Free evaluation and firm quote before any paid work. [Full guarantee details](/no-fix-no-fee). Head swap and surface damage require a 50% deposit because donor parts are consumed in the attempt.

Rush fee+$100 rush fee to move to the front of the queueDonor drivesDonor drives are matching drives used for parts. Typical donor cost: $50–$150 for common drives, $200–$400 for rare or high-capacity models. We source the cheapest compatible donor available.Target driveThe destination drive we copy recovered data onto. You can supply your own, or we'll provide one. For larger capacities (8TB, 10TB, 16TB and above), target drives cost $400+ extra. All prices are plus applicable tax.

Sealed helium drives are on their own price list, $200–$5,000+. When a head swap or platter repair opens one, we refill it with helium. That adds $400–$800, and the donor has to be an exact match. [Helium drive prices](/hard-drive-data-recovery-cost#helium-pricing)

## Data Recovery Standards & Verification

Our Austin lab operates on a transparency-first model. We use industry-standard recovery tools, including [PC-3000](/pc-3000-data-recovery-tool) and DeepSpar, combined with strict environmental controls to maintain drive integrity. This approach allows us to serve clients nationwide with consistent technical standards.

### [Localized Clean Zone](/do-you-really-need-a-clean-room-for-hard-drive-data-recovery)

Open-drive work is performed in a [0.02 micron ULPA-filtered laminar clean bench](/do-you-really-need-a-clean-room-for-hard-drive-data-recovery).

### Transparent History

Serving clients nationwide via mail-in service since 2008. Our lead engineer holds [PC-3000 and HEX Akademia certifications](/data-recovery-certifications) for hard drive firmware repair and mechanical recovery.

### Media Coverage

Our repair work has been covered by [The Wall Street Journal](https://www.wsj.com/tech/personal-tech/how-the-right-to-repair-might-save-your-gadgetsand-save-you-money-11630324800) and [Business Insider](https://www.businessinsider.com/apple-macbook-pro-repair-quote-unauthorized-2018-12), with [CBC News](https://www.cbc.ca/news/thenational/complete-control-apple-accused-of-overpricing-restricting-device-repairs-1.4859099) reporting on our pricing transparency. Louis Rossmann has [testified in Right to Repair hearings](https://en.wikipedia.org/wiki/Louis_Rossmann) in multiple states and founded the Repair Preservation Group.

### Aligned Incentives

Our "No Data, No Charge" policy means we assume the risk of the recovery attempt, not the client.

LR

### Technical Oversight

Louis Rossmann

Our engineers review all lab protocols to maintain technical accuracy and honest service. Since 2008, his focus has been on clear technical communication and accurate diagnostics rather than sales-driven explanations.

We believe in showing the bench rather than just describing it. Open-drive work runs on a 0.02 micron ULPA-filtered laminar clean bench, and we filmed it.

[See the particle counter test at the bench](/do-you-really-need-a-clean-room-for-hard-drive-data-recovery)

Overview

## PostgreSQL Recovery FAQ

Can you recover a PostgreSQL database from a physically failed drive?

Yes. We image the failed drive using PC-3000, reconstruct the file system, and extract the PostgreSQL data directory (base/, pg_wal/, pg_tblspc/). Once the cluster files are recovered, we repair pg_control, rebuild missing WAL segments, and bring the database online. No data, no fee.

What happens if pg_control is corrupted?

pg_control stores the cluster's checkpoint location, timeline ID, and system identifier. When it is corrupted, PostgreSQL refuses to start. We reconstruct pg_control from the WAL segment headers and pg_wal directory contents, matching the correct checkpoint LSN and timeline.

Is pg_resetwal safe to run on a corrupted cluster?

pg_resetwal forces PostgreSQL to start by overwriting pg_control and discarding WAL history. This can cause silent data loss: any transaction that was committed but not yet checkpointed will be lost, and tables may contain partial writes. If the drive has physical damage, pg_resetwal also masks the extent of data loss. We avoid pg_resetwal entirely and reconstruct pg_control from the recovered WAL segments instead.

Can you recover TOAST data from a corrupted cluster?

Yes. PostgreSQL stores values over 2KB in TOAST tables (pg_toast schema). When the main table's heap file is intact but the TOAST relation is damaged, queries return errors for oversized columns. We extract TOAST chunks directly from the recovered heap files and reassemble the original values.

Do you support PostGIS spatial data recovery?

Yes. PostGIS geometry and geography columns are stored as binary in standard PostgreSQL heap pages. The recovery process is identical to standard column recovery. Spatial indexes (GiST/SP-GiST) are rebuilt automatically when the database starts after recovery.

How is PostgreSQL recovery priced?

Pricing is based on the physical condition of the drive holding the PostgreSQL data directory. File system corruption: From $250. Firmware repair: $600–$900. Head swap: $1,200–$1,500. Database cluster repair is included. No data, no fee.

[No Data, No FeeGuarantee](/no-fix-no-fee)

[2.64MSubscribers](https://www.youtube.com/playlist?list=PLkVbIsAWN2lsPTNFBoEWjDyAHPcEARZtW)

[4.91,837+ Google Reviews](/reviews)

Since 2008

Established

[Repairs on VideoFull Transparency](/videos)

As Featured In

[BBC News](https://www.bbc.com/news/technology-57763037)/

[CBC News](https://www.cbc.ca/news/thenational/complete-control-apple-accused-of-overpricing-restricting-device-repairs-1.4859099)/

[ABC Australia](https://www.abc.net.au/news/2025-07-20/youtuber-louis-rossmann-takes-on-better-way-electronics/105532410)/

[Wall Street Journal](https://www.wsj.com/tech/personal-tech/how-the-right-to-repair-might-save-your-gadgetsand-save-you-money-11630324800)/

[Business Insider](https://www.businessinsider.com/apple-macbook-pro-repair-quote-unauthorized-2018-12)/

[Vice](https://www.vice.com/en/article/dhs-seized-aftermarket-apple-laptop-batteries-from-independent-repair-expert-louis-rossman)/

[Fast Company](https://www.fastcompany.com/91387927/clippy-is-back-as-a-mascot-for-big-tech-protests)/

[404 Media](https://www.404media.co/developer-unlocks-newly-enshittified-echelon-exercise-bikes-but-cant-legally-release-his-software/)/

[Tom's Hardware](https://www.tomshardware.com/pc-components/ssds/louis-rossman-threatens-to-take-samsung-to-court-over-dead-4tb-990-pro-ssd-after-ssd-maker-failed-to-replace-the-drive-under-warranty)/

[Tom's Hardware](https://www.tomshardware.com/3d-printing/louis-rossmann-tells-3d-printer-maker-bambu-lab-to-go-bleep-yourself-over-its-lawsuit-against-enthusiast-right-to-repair-advocate-offers-to-pay-the-legal-fees-for-a-threatened-orcaslicer-developer)

Related services

## Related Recovery Services

[Database Recovery HubAll supported database engines](/services/database-recovery)[MySQL RecoveryInnoDB tablespace, ibdata1, redo log repair](/services/database-recovery/mysql)[RAID Data RecoveryRAID 0, 1, 5, 6, 10 arrays](/services/raid-data-recovery)[Server Data RecoveryDell, HP, IBM enterprise servers](/services/server-data-recovery)[Hard Drive RecoveryMechanical HDD recovery](/hard-drive-data-recovery)[SSD Data RecoveryNVMe, M.2, SATA solid state drives](/services/ssd-data-recovery)

## Recover Your PostgreSQL Database

Call Mon-Fri 10am-6pm CT or email for a free drive evaluation.

[Start Recovery](/contact)[All Database Services](/services/database-recovery)

[(512) 212-9111](tel:+15122129111)Mon-Fri 10am-6pm CT

No diagnostic fee

No data, no fee

4.9 stars, 1,837+ reviews