Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A user deleted a directory containing an important file over a Samba share. Share was from a Nexenta box running ZFS, raid-Z3.

Last backup was 12 hours ago - is there a way to recover the 1 day's work?

Edit:
Asked about topic on Nexenta forums, similar responses.

share|improve this question
1  
Is your ZFS configured to do any snapshotting? –  Shane Madden Jan 19 '12 at 17:02
    
Snapshots only exist for system upgrades - the previous one was a month ago when the file did not exist. –  Tom Paine Jan 19 '12 at 17:09
2  
Then you will be of luck, I fear. Snapshotting is easy, why don't you use this, at least for intra-day purposes between regular backups? –  SvW Jan 19 '12 at 17:14
add comment

3 Answers 3

up vote 2 down vote accepted

Here's an example (albeit from 2008) of how one might use zdb/mdb to find the older uberblock and recover the orphaned file. Probably not too practical for single file undelete, but I had an unmountable raidz pool which was mostly recoverable after winding back past a dozen corrupt uberblocks. Given infinite time I don't think I could've ever done it, but with the help of a ZFS uber-guru like George Wilson such things are possible.

http://mbruning.blogspot.com/2008/08/recovering-removed-file-on-zfs-disk.html

share|improve this answer
add comment

If you're not running snapshots then restoring from backup is your only option.

I would advise you to look into snapshotting, as it's extremely useful on fileservers. Users are dumb, and they overwrite/delete files way more often than you can run a backup.

Edit: As mentioned by ErikA - providing snapshots on a file server also gives users a easy way of finding the old copies on their own. In Windows you'll just have to right click the folder/file and select "Previous versions".

share|improve this answer
3  
Additionally, the snaps can be exposed very easily to the users, enabling them to do restore things themselves. –  EEAA Jan 19 '12 at 17:18
    
No way to recover based on open file handles or some zdb block-fu? –  Tom Paine Jan 19 '12 at 17:39
    
@ErikA: ZFS snapshots can be exposed to end users over Samba? That is awesome! –  StrangeWill Jan 19 '12 at 18:33
2  
@StrangeWill - Yes, as well as via all their other NAS file sharing protocols. I've used it mostly via NFS. –  EEAA Jan 19 '12 at 19:43
1  
@TomPaine: Here's an example (albeit from 2008) of how one might used zdb/mdb to find the older uberblock and recover the orphaned file. Probably not too practical for single file undelete, but I had an unmountable raidz pool which was mostly recoverable after winding back past a dozen corrupt uberblocks. Given infinite time I don't think I could've ever done it, but with the help of a ZFS uber-guru like George Wilson such things are possible. mbruning.blogspot.com/2008/08/… –  notpeter Dec 6 '12 at 17:21
show 7 more comments

Right now your only option is restoring from backup as has previously been stated. I'd highly recommend using snapshots and integrating those into your backup workflow.

First of all you will only be backing up changes and new files once you've done a full backup and go with snapshots from there and it may also increase your flexibility depending on how you do backups now. Considering you're on a 12 hour backup schedule you could do hourly ZFS Snapshots in between and keep those for a few days. You could probably even integrate the snapshots themselves into your backup mechanism using send/receive. Its a great feature for incremental backups.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.