NAS and Server Recovery
TrueNAS / FreeNAS Data Recovery
We recover ZFS pools from degraded and faulted TrueNAS and FreeNAS systems. Vdev reconstruction, dataset extraction, GELI decryption (with your key), and iXsystems hardware failures. Free evaluation. No data = no charge.
How TrueNAS ZFS Pools Fail and How We Recover Them
TrueNAS (and its predecessor FreeNAS) uses ZFS as its sole filesystem. ZFS pools consist of one or more vdevs (mirror, RAIDZ1, RAIDZ2, or RAIDZ3), each containing multiple physical drives. When enough drives in a vdev fail that ZFS can no longer reconstruct missing data from parity, the pool status changes to FAULTED and ZFS refuses to import it. Recovery requires imaging every drive in the pool, reconstructing the vdev geometry from ZFS label data, and force-importing the pool from images to extract datasets and zvols.
ZFS checksums every block of data and metadata using SHA-256 (or fletcher4 for non-dedup configurations). This means ZFS can detect silent corruption that traditional RAID controllers miss. The downside: when ZFS detects a checksum mismatch and cannot correct it from parity, it returns an I/O error rather than silently serving corrupt data. This is the correct behavior, but it means scrub errors on a degraded pool are a warning sign that more data may become inaccessible if another drive fails.
Common TrueNAS Failure Scenarios
RAIDZ1 Double Drive Failure
RAIDZ1 tolerates one drive failure. A second failure in the same vdev causes the pool to fault. If the second drive developed bad sectors gradually (common with same-batch drives of the same age), the pool may have been serving data with correctable errors before the complete failure.
Failed Resilver
Resilvering (ZFS rebuild) writes to all surviving drives in the vdev. If a surviving drive has bad sectors in the areas being resilvered, ZFS cannot complete the rebuild and may fault the pool. A failed resilver is the most common TrueNAS failure scenario we see.
Controller or Backplane Failure
iXsystems TrueNAS appliances and custom builds use SAS/SATA HBAs or RAID controllers in IT mode (passthrough). If the HBA or backplane fails, all drives disconnect simultaneously. The drives are healthy; only the connectivity is lost. Recovery involves imaging the drives through a known-good HBA.
Accidental Pool Destruction
Running zpool destroy or zpool labelclear wipes the ZFS labels from each drive. If no new data has been written, the uberblocks and metadata trees are still on disk. We scan for historical uberblocks and reconstruct the pool from the most recent valid transaction group.
Scrub Errors Accumulating
ZFS scrubs verify every block checksum on every drive. If scrub reports uncorrectable errors (cksum column in zpool status), data blocks are failing and ZFS cannot reconstruct them from parity. This is a precursor to pool failure if another drive drops.
Boot Drive Failure
TrueNAS CORE and SCALE install the OS on a separate boot pool (typically a USB drive or small SSD mirror). If only the boot drive fails, the data pool is unaffected. Reinstalling TrueNAS on a new boot drive and reimporting the pool restores access. We see cases where admins inadvertently destroy pool metadata during the reinstall.
ZFS On-Disk Structures Relevant to Recovery
Understanding ZFS internals is required for targeted recovery. For a deeper technical treatment, see our ZFS pool recovery guide.
ZFS Labels and Uberblocks
- Each drive has four ZFS label copies: two at the beginning (L0, L1) and two at the end (L2, L3) of the device
- Labels contain the pool name, GUID, vdev tree, and an array of 128 uberblocks (root pointers to the ZFS object tree)
- The uberblock with the highest transaction group (txg) number is the most recent consistent state of the pool
- If labels are corrupted, we scan for uberblocks at known offsets across the drive to find a valid root pointer
MOS, DSL, and Dataset Objects
- The Meta Object Set (MOS) is the root of the ZFS object tree; the uberblock points to it
- The Dataset and Snapshot Layer (DSL) tracks all datasets, zvols, and snapshots in the pool
- Each dataset has its own object set containing dnodes (ZFS inodes) that map files to their on-disk block pointers
- If the MOS is damaged, we traverse the block pointer tree manually using known dnode sizes and indirect block structures
GELI Encryption and TrueNAS SCALE Native Encryption
TrueNAS CORE uses GELI (FreeBSD disk encryption) for encrypted pools. GELI operates below ZFS: it encrypts entire disk partitions using AES-XTS-256 before ZFS accesses them. Without the GELI master key (or the passphrase/keyfile used to derive it), the raw disk data is indistinguishable from random bytes.
- GELI key storage: TrueNAS CORE stores the GELI recovery key in the system dataset (on the boot pool). If the boot pool is lost and you did not export a backup of the key, the encrypted pool is unrecoverable. Always export and store the GELI recovery key offsite.
- TrueNAS SCALE encryption: SCALE uses ZFS native encryption, which encrypts at the dataset or zvol level. The encryption key is stored in the ZFS metadata itself (protected by a user passphrase or keyfile). This is a different mechanism than GELI: we do not need FreeBSD GELI tools, but we do need the ZFS encryption passphrase or keyfile.
- Recovery with key material: If you provide the correct key (GELI master key, GELI recovery key, or ZFS encryption passphrase), we attach the encryption layer to the drive images and import the pool normally. The decryption happens on our workstation; your key material is used in memory and not written to our storage.
Recovery Methodology for IT Administrators
1. Drive Imaging
Every drive in the TrueNAS system is imaged through PC-3000 with write-blocking. SAS drives (common in iXsystems rackmount appliances) are imaged via SAS HBAs. For drives with bad sectors, we capture healthy sectors first using head maps, then retry damaged areas. We also image the boot drive(s) to extract TrueNAS configuration, GELI keys, and pool history.
2. ZFS Pool Reconstruction
We read ZFS labels from each drive image to determine pool geometry: vdev type (mirror, RAIDZ1/2/3), member ordering, and ashift (sector size alignment). The pool is imported read-only from the images. If the pool refuses to import, we locate historical uberblocks and attempt import from an earlier transaction group. For pools with corrupted spacemaps, we traverse the block pointer tree manually to locate dataset objects.
3. Dataset and Zvol Extraction
Individual datasets (file-level shares), zvols (block-level iSCSI targets or VM storage), and snapshots are extracted from the reconstructed pool. Each dataset is verified by checking file counts and sizes against what ZFS metadata reports. For zvols used as VM storage, we also verify the guest filesystem integrity (NTFS, ext4, XFS).
TrueNAS Recovery Pricing
Same transparent model: per-drive imaging based on each drive's condition, plus a $400-$800 ZFS pool reconstruction fee that includes dataset extraction. No data recovered means no charge.
| Service Tier | Price Range (Per Drive) | Description |
|---|---|---|
| Logical / Firmware Imaging | $250-$900 | Firmware module damage, SMART threshold failures, or filesystem corruption on individual pool members. |
| Mechanical (Head Swap / Motor) | $1,200-$1,50050% deposit | Donor parts consumed during transplant. SAS drives (common in iXsystems appliances) require SAS-specific donors. |
| ZFS Pool Reconstruction | $400-$800per pool | Vdev reconstruction, pool import, dataset/zvol extraction. Includes GELI or ZFS native decryption if key provided. |
No Data = No Charge: If we recover nothing from your TrueNAS system, you owe $0. Free evaluation, no obligation.
Before sending drives: export your GELI recovery key (TrueNAS CORE) or ZFS encryption passphrase (TrueNAS SCALE) if your pool is encrypted. Without the key, encrypted data is unrecoverable.
TrueNAS Recovery; Common Questions
My TrueNAS pool shows FAULTED and will not import. Can you recover the data?
Should I try to replace a failed drive and resilver before contacting you?
My TrueNAS pool uses GELI encryption. Can you still recover the data?
Does TrueNAS CORE vs SCALE matter for recovery?
Ready to recover your TrueNAS system?
Free evaluation. No data = no charge. Mail-in from anywhere in the U.S.