Undelete ZFS file shared by Samba

The problem was that the new motherboard's BIOS created a host protected area (HPA) on some of the drives, a small section used by OEMs for system recovery purposes, usually located at the end of the harddrive.

ZFS maintains 4 labels with partition meta information and the HPA prevents ZFS from seeing the upper two.

Solution: Boot Linux, use hdparm to inspect and remove the HPA. Be very careful, this can easily destroy your data for good. Consult the article and the hdparm man page (parameter -N) for details.

The problem did not only occur with the new motherboard, I had a similar issue when connecting the drives to an SAS controller card. The solution is the same.

I haven't used zfs enough to say on data integrity. zpool list gave raidz1-0 ONLINE 0 0 0 c8t1d0p0 ONLINE 0 0 0 c8t2d0p0 ONLINE 0 0 0 c8t3d0p0 ONLINE 0 0 0

smartctl -d sat,12 -a /dev/rdsk/c8t3d0p0 listed specific attributes. -d sat -d ata -d scsi may get it to work depending on what type of drives you have. look at raw read error rate, relocated sector count, seek error rate, hardware ecc, and pending sector relocation. -t short or -t long instead of -a will start a test. the long test can take one or many hours depending on the drive. the read seak and hardware errors are not neccessarly a failure. how ever if they keep jumping between listings they can be a good indicator. Also some drive manufacturers may require you use their tools to get a drive rma'd.

If I were in your position and unsure about the drive I would get a replacement and after either verifying its good through working with the manufacturer or having it rma. I would put in the extra drive as a hot spare so that if it happens again you have another drive ready and waiting. z2 is not a bad idea either but I would still keep a spare in the wings. with the size of drives now they do take a long time to rebuild and it is possible to hit a 2nd error.

as to corrupted files if you still have an original some where else of one of those "corrupted" files do a md5 calculation of it and then see if the corrupted file's md5 matches. that will tell you if bits got damaged. if not then there may be invisible damage to the files. whether its enough damage to be a problem will be up to you.