up vote 0 down vote favorite
share [g+] share [fb]

A user deleted a directory containing an important file over a Samba share. Share was from a Nexenta box running ZFS, raid-Z3.

Last backup was 12 hours ago - is there a way to recover the 1 day's work?

Edit:
Asked about topic on Nexenta forums, similar responses.

link|improve this question
75% accept rate
1  
Is your ZFS configured to do any snapshotting? – Shane Madden Jan 19 at 17:02
Snapshots only exist for system upgrades - the previous one was a month ago when the file did not exist. – Tom Paine Jan 19 at 17:09
2  
Then you will be of luck, I fear. Snapshotting is easy, why don't you use this, at least for intra-day purposes between regular backups? – SvenW Jan 19 at 17:14
feedback

2 Answers

up vote 6 down vote

If you're not running snapshots then restoring from backup is your only option.

I would advise you to look into snapshotting, as it's extremely useful on fileservers. Users are dumb, and they overwrite/delete files way more often than you can run a backup.

Edit: As mentioned by ErikA - providing snapshots on a file server also gives users a easy way of finding the old copies on their own. In Windows you'll just have to right click the folder/file and select "Previous versions".

link|improve this answer
3  
Additionally, the snaps can be exposed very easily to the users, enabling them to do restore things themselves. – ErikA Jan 19 at 17:18
No way to recover based on open file handles or some zdb block-fu? – Tom Paine Jan 19 at 17:39
@ErikA: ZFS snapshots can be exposed to end users over Samba? That is awesome! – StrangeWill Jan 19 at 18:33
1  
@StrangeWill - Yes, as well as via all their other NAS file sharing protocols. I've used it mostly via NFS. – ErikA Jan 19 at 19:43
I've heard of people editing the disk to have ZFS use a previous state, but I don't know of a utility to do that. This would allow you to get to the files if they hadn't been over written. In addition, I've heard of some data carving tools that would be used on ZFS, mainly for forensics. – Scott McClenning Jan 26 at 5:24
show 5 more comments
feedback
up vote 1 down vote

Right now your only option is restoring from backup as has previously been stated. I'd highly recommend using snapshots and integrating those into your backup workflow.

First of all you will only be backing up changes and new files once you've done a full backup and go with snapshots from there and it may also increase your flexibility depending on how you do backups now. Considering you're on a 12 hour backup schedule you could do hourly ZFS Snapshots in between and keep those for a few days. You could probably even integrate the snapshots themselves into your backup mechanism using send/receive. Its a great feature for incremental backups.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.