Dataset deleted, need to recover data

[Dean Rantala]

Linux system admin here trying to help a friend out. I am not that well versed with BSD and especially not ZFS.

That aside, I spent a couple hours and came up pretty dry.

Overview of what he told me he done:
-> Installed FreeNAS and copied over 900 movies to /mnt/ExtStorage1/Videos
-> Created a jail (not sure the details)
-> Created a dataset
-> Deleted the dataset
-> All filesunder /mnt/ExtStorage1/Videos are now gone

Now before we get into a "google search" shouting match, let me explain me confusion and outline what I am trying to figure out.

For starters, I am trying to understand just what he did. What makes this even more dificult is that he is a little green to anything *nix-related and cannot clearly explain what he did from the web GUI. But there is some hope, here is the "zfs history" log:

2015-03-29.12:53:27 zfs create -o aclmode=restricted -o casesensitivity=sensitive ExtStorage1/Movies
2015-03-29.13:00:11 zfs create -o aclmode=restricted -o casesensitivity=sensitive ExtStorage1/Jails
2015-03-29.13:04:30 zfs create -o mountpoint=/ExtStorage1/Videos/.warden-template-standard -p ExtStorage1/Videos/.warden-template-standard
2015-03-29.13:14:41 zfs snapshot ExtStorage1/Videos/.warden-template-standard@clean
2015-03-29.13:15:12 zfs clone ExtStorage1/Videos/.warden-template-standard@cleanExtStorage1/Videos/PlugIn Jail
2015-03-29.13:20:17 zfs destroy -r ExtStorage1/Jails
2015-03-29.17:28:37 zpool import -c /data/zfs/zpool.cache.saved -o cachefile=none -R /mnt -f 12828336135469962757
2015-03-29.17:28:37 zpool set cachefile=/data/zfs/zpool.cache ExtStorage1

It want to point out that he performed all steps from the web GUI (none of this was done by him manually typing out the commands).

Now the confusing part - for me - is that after his files went "missing" from the /mnt/ExtStorage1/Videos directory, the storage space left on the FreeNAS (ExtStorage1) zpool still shows as only 500GB left (out of 2.6TB). So the thought is that his files are still there.

I have (from a command line) changed into the /mnt/ExtStorage1 directory and run a 'du -hs *', as well as several other commands and can verify that - as far as I can see - his files are truly gone. But 'df -h' shows /mnt/ExtStorage1 as only having 500GB left (his movies were over 2TB of space).

I did some basic research and ran a scrub on ExtStorage1 (command completed in 10 seconds or so).

Thoughts?

 

[SweetAndLow]

I suspect Video was a directory not a dataset then they created a dataset with the same name and it got mounted in the same place as the directory. Try unmounting the video dataset and check for the videos again.

 

[danb35]

To do what @SweetAndLow suggests, from the CLI, do 'zfs unmount ExtStorage1/Videos' and see if the data reappears. Another possibility is that the space is taken up with snapshots, and if so, the data may be recoverable that way. To see if that's the case, try 'zfs list -t snapshot' and see what comes up.

 

[cyberjock]

The OS should not let you create a dataset if a directory or file with the same name exists. So unless he's using an old version, this isn't possible.

df/du really aren't good choices for ZFS as they don't understand things like snapshots, replication, etc.

So it is possible that he deleted the files somehow, but a snapshot is still protecting the data. So you should check to see if snapshots exist. You should also do this sooner than later in case they have a short expiration time (say 3 days or something) as they will *autodelete* when they expire.

 

[Dean Rantala]

Just a follow-up.

So somehow the GUI **DID** allow a folder to be mounted on a non-empty directory. Not sure how, but it did.

Additionally, there WAS a dataset of the same name (at least from the GUI) as "Videos". After we had access to the movies, I renamed the folder and THEN deleted the duplicate datasets.

Everything is cleaned up now. Again, not sure how he did it, but it happened. This is also the latest version (as of a couple weeks ago). Not that old.

- Dean

 

[DGenerateKane]

The OS should not let you create a dataset if a directory or file with the same name exists. So unless he's using an old version, this isn't possible.

df/du really aren't good choices for ZFS as they don't understand things like snapshots, replication, etc.

So it is possible that he deleted the files somehow, but a snapshot is still protecting the data. So you should check to see if snapshots exist. You should also do this sooner than later in case they have a short expiration time (say 3 days or something) as they will *autodelete* when they expire.

I can attest that 9.3 can indeed create a dataset with the same name as an existing directory.

 

[Ericloewe]

I can attest that 9.3 can indeed create a dataset with the same name as an existing directory.

I highly recommend that whoever can duplicate this and can supply instructions open a ticket.

 

[cyberjock]

I can attest that 9.3 can indeed create a dataset with the same name as an existing directory.

I'm gonna echo what Ericloewe said. I have tried to do this many times before. I have always gotten red warning text that I can't do that.