Help please. Folder deleted

[Kanky]

Hi Guys,

Need some help please.

I have a folder on a Freenas 9.10 machine. I went to access a file on the machine to find the entire folder was gone. I immediately thought that perhaps someone had deleted it by mistake.

However when I view the .recycle folders for the users the folder it spread between all of the users. If that makes sense. When I click into some of the sub-folders the contents are not as expected. There is lots of tmp files and files with '#3 of ~$MS' in the file name.

Do you have have any idea if this was user error, system crash or perhaps something else? Do you know if there is a way to recover the folders?

Thanks in advance!

 

[Koala]

Do you have snapshots?

 

[Kanky]

Yes I believe so. They are each about 256.0 KiB?

 

[fracai]

You can't really rely on the size of the snapshot to verify that it contains the information you're looking for. Snapshots only report the amount of data that is unique to that snapshot. If two snapshots point to the same 10 GB file and nothing else, they will report their size as very close to zero; there's usually some space taken up for metadata.

You can check the contents of the snapshot by looking at /mnt/<dataset>/.zfs/snapshot/<snapshot_name>
You can copy files from that directory as well.

You can check the changes between two snapshots with: zfs diff dataset@<snapshot_1> dataset@<snapshot_2>

Or compare a snapshot to the current state with: zfs diff dataset@<snapshot>

 

[Kanky]

Thanks for the help. All sorted now. The folder wasn't deleted. Some had simply dragged and dropped into a different location.

This was actually a wake up call for me. When I viewed the snapshots they were all essentially empty!

When I investigated it I didn't have recursive turned on, so the only thing it was Snapshotting was the root level of the dataset.... Lesson Learnt!

 

[danb35]

When I investigated it I didn't have recursive turned on,

Good thing you found this out now. Someone else here, not too long ago, had been hit by a Cryptolocker attack, and it was only then that he discovered his snapshots weren't recursive. He was not a happy camper.